1.8 Prepare, Obtain, and Manage Security Budget ISSMP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   What is a common approach to requesting additional budget due to evolving risks?

   • APresenting a revised risk assessment and the cost of mitigation
   • BReducing other security controls to fund the new risk
   • CRequesting a blanket increase without details
   • DWaiting for the next annual budget cycle
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   When should the security budget be adjusted based on evolving risks?

   • AOnly at the end of the fiscal year
   • BWhen the budget is underspent
   • CWhen a new significant threat emerges that increases the organization's risk exposure
   • DWhenever the security team wants new technology
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   What is the purpose of financial reporting for the security budget?

   • ATo hide any overspending from stakeholders
   • BTo replace the need for an audit
   • CTo provide a detailed technical analysis of security controls
   • DTo communicate budget performance and outcomes to management and stakeholders
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial services firm is preparing its annual security budget. The risk assessment shows a high likelihood of a data breach due to outdated encryption on customer data. The compliance team also requires new logging for a regulatory mandate. The CISO wants to ensure the budget reflects the most critical needs. What should the CISO do first?

   • AFund the encryption upgrade and the logging requirement equally, as both are important.
   • BRequest a budget increase to cover both projects without prioritizing.
   • CPrioritize the encryption upgrade because it directly reduces the highest-risk vulnerability, then include the logging requirement.
   • DDefer both projects and wait for a new risk assessment next year.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   At the end of the fiscal year, a security manager must report to the board on how the security budget was spent. The report should demonstrate the value delivered and justify future investment. Which approach is most effective?

   • AFocus on the percentage of budget spent and avoid discussing specific outcomes.
   • BProvide a detailed list of every purchase, including software licenses, hardware, and consulting fees.
   • CPresent a summary of expenditures by category, along with key performance indicators showing risk reduction and compliance improvements.
   • DHighlight only the successful projects and omit any areas where spending exceeded the plan.
   Reveal Solution Discussion Select an answer first