Define How Security Controls Contribute to Business Operating Cost and Offsetting Risk. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–22

1. 21application · medium

   A non-profit organization with a very low risk appetite and limited budget is deciding how to allocate its $50,000 annual security budget. The risk assessment identifies three key risks: (1) phishing attacks with a $200,000 potential impact, (2) unpatched vulnerabilities with a $150,000 potential impact, and (3) insider data theft with a $300,000 potential impact. Which investment strategy BEST aligns with the organization's low risk appetite and budget constraints?

   • AInvest in a comprehensive security awareness training program and a patch management solution
   • BPurchase a cyber insurance policy to transfer all three risks
   • CSplit the budget evenly across all three risks to ensure balanced coverage
   • DInvest the entire budget in a DLP solution to address insider data theft
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A startup with a high risk appetite is launching a new product and wants to minimize upfront security spending to accelerate time-to-market. The CISO proposes a basic set of controls: cloud-native logging, default encryption, and a vulnerability scanner. The board asks why they are not investing in a full SIEM and 24/7 SOC. Which response BEST aligns the security investment with the organization's risk appetite?

   • AThe board should approve the full SIEM/SOC because security spending is always justified
   • BA full SIEM and 24/7 SOC are required to meet any reasonable security posture
   • CThe basic controls are cheaper, but the company should expect to be breached
   • DThe basic controls address the most critical risks for a startup, and a full SIEM/SOC can be added as the company matures and risk tolerance decreases
   Reveal Solution Discussion Select an answer first