1.8 Prepare, Obtain, and Manage Security Budget ISSMP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security manager is preparing the annual budget and must decide how to allocate funds between a new SIEM system and an upgrade to the existing endpoint protection. The SIEM will improve threat detection, while the endpoint upgrade will address a known vulnerability that has been exploited in the industry. The budget is limited. What is the best decision?

   • AFund the SIEM because it provides broader visibility and long-term value.
   • BSplit the budget equally between the two projects.
   • CDefer both projects and wait for the next risk assessment.
   • DFund the endpoint upgrade because it directly mitigates a known active threat.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security manager is managing the budget and learns that a new regulation will require additional data retention and monitoring. The current budget does not include these costs. The manager needs to secure additional funding. What is the first step?

   • AReduce spending on other security projects to free up funds without approval.
   • BWait until the next budget cycle to request the funds.
   • CPrepare a cost estimate for the new requirements and submit a budget adjustment request to the approval authority.
   • DImmediately implement the required controls and worry about the budget later.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security manager discovers that a project has spent 80% of its allocated budget with only 40% of the work completed. The project is critical for compliance. The manager must decide how to proceed. What is the most appropriate action?

   • AStop the project immediately and report the overspending to the CFO.
   • BReduce the project scope to fit the remaining budget.
   • CAnalyze the variance, identify the cause, and develop a corrective plan that may include reallocating funds or requesting additional budget.
   • DTransfer funds from other security projects to cover the shortfall without approval.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security manager must report to the board on the security budget's performance. The board wants to know if the budget was spent as planned and if the outcomes were achieved. Which report format best meets this need?

   • AA dashboard that combines budget variance with key performance indicators for security outcomes.
   • BA list of all security incidents that occurred during the year.
   • CA narrative report describing the activities completed during the year.
   • DA financial statement showing actual vs. planned expenditures by category.
   Reveal Solution Discussion Select an answer first
6. 25foundation · medium

   What is a key activity in executing the approved security budget?

   • ADeferring all spending until the end of the fiscal year
   • BAllocating funds to specific security initiatives and cost centers
   • CRevising the budget to match actual spending
   • DIgnoring the budget once it is approved
   Reveal Solution Discussion Select an answer first