1.8 Prepare, Obtain, and Manage Security Budget ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · medium

   Which activity is part of the annual security budget preparation process?

   • APerforming a penetration test on the network
   • BConducting a post-incident review
   • CEstimating the costs of security controls and initiatives
   • DConfiguring a new firewall rule
   Reveal Solution Discussion Select an answer first
2. 17foundation · medium

   Why is tracking expenditures important during budget execution?

   • ATo justify the need for a larger budget next year
   • BTo provide a basis for next year's budget without any analysis
   • CTo ensure spending stays within the approved budget and identify variances
   • DTo ensure that all funds are spent by year-end
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security manager is monitoring the budget and notices that spending on security awareness training is significantly lower than planned because the training vendor raised prices and the team found a cheaper alternative. The manager wants to use the savings to fund a new phishing simulation tool. What should the manager do?

   • AReturn the savings to the general fund at the end of the year.
   • BUse the savings immediately to purchase the phishing simulation tool.
   • CDocument the savings and request approval to reallocate the funds to the phishing simulation tool.
   • DKeep the savings as a contingency reserve for future unplanned needs.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security manager must present the annual security budget report to the board. The report shows that the security team spent 95% of the budget, but the board is concerned that the return on investment is unclear. The manager needs to improve the report. What is the best way to address the board's concern?

   • AProvide a comparison of the budget to industry benchmarks to show the company is spending appropriately.
   • BFocus the report on the number of security incidents prevented during the year.
   • CAdd a section that maps each major expenditure to a specific risk reduction or compliance outcome.
   • DExplain that security spending is a cost of doing business and cannot be measured in terms of ROI.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A manufacturing company is preparing its annual security budget. The CISO has identified mandatory compliance requirements, a legacy ERP system that needs a security upgrade, and a new zero-trust initiative. The CFO has asked for a budget that clearly ties each proposed expenditure to a business outcome. Which approach best aligns the security budget with organizational goals?

   • ARequest the maximum budget possible and then adjust allocations after approval based on actual needs.
   • BDevelop a business case for each initiative, linking it to risk reduction, regulatory obligations, and strategic objectives, then present the prioritized portfolio to the CFO.
   • CAllocate the budget equally across all three areas to ensure balanced coverage.
   • DPrioritize the compliance requirements, then the legacy ERP upgrade, and defer the zero-trust initiative to next year.
   Reveal Solution Discussion Select an answer first