1.8 Prepare, Obtain, and Manage Security Budget ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   Midway through the fiscal year, a security manager learns of a new ransomware campaign targeting the company's industry. The current budget has no funds for additional threat intelligence or endpoint detection upgrades. The manager needs to respond quickly. What is the best first step?

   • AImmediately purchase the new endpoint detection licenses using the general IT budget.
   • BDraft a risk-based justification for additional funding, including the likelihood and impact of the threat, and submit it to the budget approval authority.
   • CReallocate funds from the security awareness training program to cover the new costs.
   • DWait until the next budget cycle to request the funds, as mid-year changes are not permitted.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   What is a key strategy for justifying the security budget to stakeholders?

   • ALinking security investments to business risks and potential impacts
   • BComparing the budget to the previous year's budget without explanation
   • CPresenting the budget as a fixed, non-negotiable requirement
   • DFocusing only on technical details of security controls
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A global company is preparing its annual security budget. The company operates in multiple regions with different data protection regulations. The CISO must balance the need for a consistent global security posture with the need to meet local regulatory requirements. The budget is limited. What is the best approach?

   • ADevelop a global baseline budget for common security controls, then add region-specific allocations for regulatory requirements.
   • BRequest a budget increase to cover all regional requirements without prioritization.
   • CCreate a single global budget and let regional managers decide how to spend it.
   • DAllocate the budget to the regions with the most stringent regulations and ignore the others.
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   Which element is typically included in a security budget financial report?

   • AComparison of planned versus actual expenditures
   • BA list of all security incidents in the past year
   • CA detailed network architecture diagram
   • DA summary of employee performance reviews
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security manager is responsible for a budget that includes several projects. The manager wants to ensure that each project stays within its allocated amount and that the overall budget is not exceeded. Which tool or practice is most effective for this purpose?

   • AA policy that requires all purchases to be approved by the security manager.
   • BA quarterly review of all project expenditures.
   • CA financial management system that provides real-time tracking, alerts, and variance reports.
   • DA spreadsheet that tracks actual spending against each project's budget on a monthly basis.
   Reveal Solution Discussion Select an answer first