Free CCISO Practice Exam (2026)

Your score by topic

Get a free CCISO study plan on WhatsApp See CCISO Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Executive Leadership⚑ Flag

The CISO of Harborline Insurance reports to the CIO. Twice this year the CIO has postponed critical patching to protect project deadlines and has asked the CISO to leave those delays out of risk reports. The CISO believes this pattern is weakening the security program. What is the BEST long-term remedy?

AMove all patching tasks from IT operations into the security team BRaise the issue informally with the CEO at the next social event CSet up an independent reporting path to a risk or audit committee DAsk the CIO to sign a risk acceptance form every time patching is delayed

Correct answer: C. Set up an independent reporting path to a risk or audit committee
A direct or dotted-line path to a board risk or audit committee gives the CISO the independence to report risk honestly when the CIO has a conflict of interest. Risk acceptance forms help, but they still leave the conflicted CIO in control of what reaches leadership.

Question 2Governance, Risk & Audit⚑ Flag

The board of a regional bank recently created a technology committee. One committee member has started asking the CISO to send individual firewall change requests for the member's approval. The CISO wants to keep the board engaged without slowing operations. What is the BEST approach?

AGive the committee member direct access to the change management system so every request is visible BClarify that the board oversees risk and direction, while management approves operational changes CRoute each change request to the member as asked, because board members have authority over management DStop sending any security material to the committee until its charter has been fully rewritten

Correct answer: B. Clarify that the board oversees risk and direction, while management approves operational changes
Governance sets direction and oversees risk, while management runs daily operations such as change approvals. Routing firewall changes to a director mixes governance with management and slows the business without improving oversight.

Question 3Security Program & Operations⚑ Flag

A CISO at Harlow Logistics is asked by the CIO to approve a list of security tools that a vendor recommended for a new warehouse management platform. The business has not yet stated what the platform must protect or what failures it can tolerate. The vendor is pushing for a purchase decision by quarter end. What should the CISO do FIRST?

AApprove the tools now to keep the quarter-end vendor pricing BRun a technical bake-off of the vendor's tools against rivals CAsk internal audit to review the vendor's recommended tool list DDefine control objectives tied to the platform's business risks

Correct answer: D. Define control objectives tied to the platform's business risks
Control objectives state what risk each control must address, and they come from business requirements and risk appetite. Without them, any tool comparison or purchase has no basis for judging fit. A bake-off is premature because there is nothing yet to measure the tools against.

Question 4Core Competencies⚑ Flag

The new CISO of a national retail chain finds that identities are managed separately in over 40 business applications, with no common process. The board has approved funding for an identity and access management program. Business unit leaders worry that a new program will slow down store operations. What should the CISO do FIRST?

ADefine an IAM strategy and governance model with business owners and agreed success measures BDirect IT to merge every application directory into a single directory within the fiscal year CRequire multifactor authentication on all 40 applications before any other program work begins DPurchase an identity governance platform and begin connecting the 40 applications to it

Correct answer: A. Define an IAM strategy and governance model with business owners and agreed success measures
An IAM program must start with a strategy and governance model that business owners help shape, so priorities, ownership and success measures match business needs. Buying a platform first is premature, because tool selection should follow the strategy and requirements.

Question 5Core Competencies⚑ Flag

After a ransomware incident spread quickly across a flat network, the board of a regional logistics firm funded a two-year network segmentation program. The CISO must now report progress to the board each quarter. Board members have said they do not want technical detail. Which metric BEST shows the board that the program is reducing business risk?

ANumber of firewall rules created and reviewed by the network team each quarter BShare of critical business systems reachable from general user networks CCount of new VLANs and subnets deployed across the regional sites DPercentage of the segmentation budget spent compared to the project plan

Correct answer: B. Share of critical business systems reachable from general user networks
The share of critical systems reachable from user networks directly measures the blast radius the program is meant to shrink, which is the risk the board cares about. Firewall rule counts and VLAN counts show activity, not risk reduction, and budget burn only tracks project spend.

Question 6Core Competencies⚑ Flag

The CISO of a regional insurer reviews the last year of penetration test results. Most serious flaws in new customer applications were found weeks before go-live, causing costly rework and missed launch dates. Product owners now see security as a blocker. What is the BEST approach to address the root cause?

ADefine security requirements during planning and verify them at each SDLC phase BRequire developers to pass an annual secure coding certification exam CGive the security team authority to delay any release with open findings DAdd a second, earlier penetration test during the final user acceptance phase of work

Correct answer: A. Define security requirements during planning and verify them at each SDLC phase
Building security requirements into planning and checking them throughout the lifecycle prevents flaws instead of finding them late, which cuts rework and delays. An extra late-stage test still finds problems after design decisions are locked in, so it treats the symptom rather than the cause.

Question 7Core Competencies⚑ Flag

A newly hired CISO at a regional insurer finds an incident response plan written two years ago by the IT operations manager. It has never been reviewed by legal, communications, or executive leadership, and no one outside IT knows their role in it. What should the CISO do FIRST to make the plan effective?

AHire a consultant to benchmark the plan against peer insurers in the region BRun a full simulation exercise right away so the gaps show up under realistic pressure CRewrite the technical playbooks so they match the current security tooling DGain executive sponsorship and formal approval with defined cross-functional roles

Correct answer: D. Gain executive sponsorship and formal approval with defined cross-functional roles
An IR plan only works when leadership has approved it and every function, including legal, communications, and HR, knows its role. Running a simulation first is tempting, but testing a plan that lacks authority and assigned owners mostly confirms what is already known.

Question 8Strategy, Finance & Vendors⚑ Flag

A newly hired CISO at Brightwater Logistics is asked by the CEO to deliver a three-year information security strategy within 90 days. The previous CISO left behind a list of tool purchases but no documented strategy. Several business units are expanding into new regions next year. What should the CISO do FIRST?

AUnderstand the company's business strategy, objectives and risk appetite BRun a full technical vulnerability scan of all systems in every region CBenchmark the security budget against peer companies in the same sector DBuild the strategy around the tool purchase list the previous CISO left behind

Correct answer: A. Understand the company's business strategy, objectives and risk appetite
A security strategy must support the business strategy, so the CISO first needs to understand business goals, planned expansion and risk appetite. Reusing the old tool list is tempting, but it is a set of purchases, not a strategy tied to business outcomes.

Question 9Executive Leadership⚑ Flag

A CISO at Velmora Foods is preparing a 10-minute briefing for the board on an unpatched weakness in the plant control systems. Board members have no technical background. What should the briefing focus on MOST?

AThe CVSS scores and the attack techniques that could exploit the gap BHow long the vulnerable systems have been running without vendor support CThe potential impact on production, safety, and revenue, plus options DA comparison of the firewall and segmentation products under review

Correct answer: C. The potential impact on production, safety, and revenue, plus options
Boards make decisions based on business impact, so the CISO should translate the technical gap into effects on production, safety, and revenue and present clear options. CVSS scores and attack techniques are useful to engineers but do not help directors weigh the decision.

Question 10Governance, Risk & Audit⚑ Flag

A manufacturing company hires its first CISO. Security activities are scattered across IT, facilities and legal, and nobody agrees on who decides what. Executives say they support security but have never defined its mandate. What should the CISO do FIRST?

ADraft a security program charter defining scope, authority and accountability, with executive sign-off BCommission a full penetration test so executives can see exactly how exposed the company is CReassign all security staff from IT, facilities and legal into a single new security department DPurchase an integrated security platform so every team works from the same tools and data

Correct answer: A. Draft a security program charter defining scope, authority and accountability, with executive sign-off
A charter approved by executives establishes the program's scope, authority and accountability, which every later decision depends on. Reorganizing staff or buying tools before the mandate is defined is premature and may not have executive backing.

Question 11Security Program & Operations⚑ Flag

A hospital CISO learns that an imaging system runs an unsupported operating system. The manufacturer will not allow patching without voiding the device's regulatory clearance. Replacement is budgeted for 18 months from now, and the clinical director says the system must stay in service. What is the BEST approach?

ATake the system offline until the replacement project is funded BRecord the issue as an accepted risk with no further action needed CApply the operating system patches anyway and accept the warranty risk DSegment and monitor it under documented compensating controls

Correct answer: D. Segment and monitor it under documented compensating controls
Compensating controls reduce risk to an acceptable level when the primary control, here patching, is not feasible. Network segmentation plus monitoring lowers exposure while a clinically required system stays in service. Accepting the risk with no action ignores an exposure that can be reduced at reasonable cost.

Question 12Core Competencies⚑ Flag

An internal audit at a software company reports that most developers hold permanent administrator rights in production. Engineering leaders say the access is needed to fix outages quickly. The CISO must reduce risk without hurting service recovery. What is the BEST approach?

AAccept the risk formally because engineering leadership has explained the business need BApply least privilege with owner-approved roles and a monitored emergency access process CAdd more logging of developer activity in production while leaving the current rights in place DRemove all production access from developers and route every change through operations staff

Correct answer: B. Apply least privilege with owner-approved roles and a monitored emergency access process
Least privilege with defined roles, plus a monitored break-glass process for outages, cuts standing risk while still allowing fast recovery. Removing all access ignores a real business need and would likely slow incident response.

Question 13Core Competencies⚑ Flag

A retailer with 300 branches plans to retire its aging MPLS links and VPN concentrators. The CIO proposes moving all branch networking and security to one SASE vendor to cut costs. The CFO supports the idea because it simplifies contracts. What should be the CISO's GREATEST concern with this plan?

ANetwork engineers may need to learn a new configuration language BBranch staff will need new training on how to log in to the network CConcentration risk if the single vendor suffers an outage or failure DThe vendor's user interface may differ from the current firewall console

Correct answer: C. Concentration risk if the single vendor suffers an outage or failure
Putting all branch connectivity and security with one provider creates concentration risk, so the CISO should push for resilience requirements, SLAs and an exit strategy in the contract. Training and interface changes are real but manageable operational issues, not strategic risks to business continuity.

Question 14Core Competencies⚑ Flag

A payments company is designing a new mobile wallet that will connect to several partner banks. The CISO wants to reduce the chance that the design itself contains exploitable weaknesses. The project has just finished gathering business requirements. What should the CISO ensure happens NEXT?

AA code review of every module by an outside firm after development is done BA threat modeling session on the proposed architecture before coding begins CA full dynamic scan of the wallet once the first beta build is available DA bug bounty program launched on the day the wallet is released to the public

Correct answer: B. A threat modeling session on the proposed architecture before coding begins
Threat modeling at design time finds structural weaknesses when they are cheapest to fix and before any code exists. Dynamic scanning is valuable, but it needs a running build and cannot easily correct a flawed design after the fact.

Question 15Core Competencies⚑ Flag

At a logistics company, the SOC escalates almost every alert to the executive team by email. Executives now ignore the messages, and a real data exposure last month went unread for two days. The CISO wants to fix the escalation process. What is the BEST approach?

AReduce the number of SIEM rules so that fewer alerts reach the SOC analysts BSend executive alerts only after the SOC manager has personally reviewed each one CMove all executive escalations from email to a dedicated mobile paging app with read receipts DDefine severity levels based on business impact with approved escalation thresholds

Correct answer: D. Define severity levels based on business impact with approved escalation thresholds
A severity scheme tied to business impact and data sensitivity, approved by leadership, tells the SOC exactly which incidents reach executives and when. A different paging channel only changes how the noise arrives, and executives would still learn to ignore it.

Question 16Strategy, Finance & Vendors⚑ Flag

The security team at Halden Insurance has finished a maturity assessment that documents the current state of the security program across all NIST CSF 2.0 functions. The CISO now wants to build a multi-year roadmap. Several team members want to start buying tools for the lowest-scoring areas right away. What is the BEST next step?

ABuy tools for the lowest-scoring areas right away to show the board quick progress BDefine a target state with leadership based on business needs and risk appetite CRepeat the maturity assessment with an outside firm to validate the scores DSet every function to the highest maturity level as the target

Correct answer: B. Define a target state with leadership based on business needs and risk appetite
A gap analysis needs an agreed target state, and that target should reflect business needs and risk appetite rather than maximum maturity everywhere. Buying tools for low scores skips the step of deciding which gaps actually matter to the business.

Question 17Executive Leadership⚑ Flag

Threat monitoring at Marlowe Biotech finds online posts by activists naming the CEO, her home neighborhood and her upcoming conference schedule. The CEO plans to keep her normal routine. Corporate security and the cybersecurity team have never worked together on executive safety. What should the CISO do FIRST?

AReport the posts to the local police and wait for their guidance before acting BAsk the CEO to cancel all public appearances until the online posts stop CRun a joint threat assessment with corporate security and agree protections DHire an outside firm to take down every post that mentions the CEO by name

Correct answer: C. Run a joint threat assessment with corporate security and agree protections
Executive protection needs a combined view of online and physical threats, so cybersecurity and corporate security should judge the threat together and agree measures such as travel security and removing exposed personal details. Waiting for police guidance leaves the CEO exposed, and canceling every appearance is an overreaction before the threat is assessed.

Question 18Governance, Risk & Audit⚑ Flag

A CISO is forming an information security steering committee at a health insurer. The CIO proposes filling it with senior engineers from the security and infrastructure teams, since they understand the technology best. What is the GREATEST concern with this proposal?

ABusiness leaders who own the risks would be left out of security decisions BEngineers would need extra governance training before they could attend meetings CThe committee would be too small to meet the insurer's regulatory quorum rules DEngineers might approve tool purchases that go beyond the approved annual security budget

Correct answer: A. Business leaders who own the risks would be left out of security decisions
A steering committee exists to align security with the business, so it needs leaders who own business processes and their risks. A purely technical committee cannot make business risk decisions or secure cross-functional support, which matters far more than training or budget concerns.

Question 19Security Program & Operations⚑ Flag

Which statement BEST describes the purpose of defense in depth in a security program?

APlacing the strongest available control at the network perimeter BBuying products from several vendors for every control type CConcentrating the budget on the single most effective control DLayered controls so that one failure does not expose the asset

Correct answer: D. Layered controls so that one failure does not expose the asset
Defense in depth uses multiple independent layers of administrative, technical and physical controls so that the failure or bypass of one does not leave the asset unprotected. Vendor diversity can be part of a design, but it is not the goal and can add cost without reducing risk.

Question 20Core Competencies⚑ Flag

A global insurer uses role-based access control and now has more than 9,000 roles, many nearly identical. Access decisions also need to consider the user's location, device health and data sensitivity. The CISO is asked to recommend a direction for the access model. What is the BEST recommendation?

AAdd attribute-based policies for contextual decisions while keeping a smaller set of core roles BReplace all roles with individual user permissions so each person gets exactly what is needed CFreeze the creation of new roles and require the help desk to approve all future access requests DCreate additional roles for each location and device combination to keep the model consistent

Correct answer: A. Add attribute-based policies for contextual decisions while keeping a smaller set of core roles
Attribute-based access control handles contextual factors like location and device without multiplying roles, and a reduced set of core roles keeps administration manageable. Adding more roles would make the existing role explosion worse.

Question 21Core Competencies⚑ Flag

A food manufacturer's IT security team wants to apply the corporate 30-day patching standard to the PLCs and HMIs on its production lines. Plant managers object, saying unplanned downtime and safety are their top concerns. The OT systems are owned by plant engineering, not IT. What is the BEST approach for the CISO?

AEnforce the corporate patch standard on every line and escalate any plant manager who refuses to comply BExclude OT systems from the security program and let plant engineering manage them alone CSet up joint OT security governance with operations, using risk-based controls that respect safety DReplace the PLCs with newer models that support the corporate patching tools

Correct answer: C. Set up joint OT security governance with operations, using risk-based controls that respect safety
OT security must be governed jointly with operations because safety and availability come first, so a risk-based approach such as ISA/IEC 62443 with compensating controls fits best. Forcing IT patch rules ignores plant risk, while excluding OT entirely leaves critical systems unmanaged.

Question 22Executive Leadership⚑ Flag

Two days after containing a major data breach at Norwick Health, the CISO is asked to brief the board. Forensic work is still ongoing and some facts are unknown. What should the CISO do FIRST in the briefing?

AFocus on which staff member's error allowed the attackers to get in BDelay the briefing until the forensic report is complete and verified CPresent a detailed timeline of every technical action the SOC took DGive confirmed facts, impact, unknowns, and decisions needed

Correct answer: D. Give confirmed facts, impact, unknowns, and decisions needed
After a major incident, the board needs a clear picture of what is confirmed, what is still unknown, the business impact, and what decisions it must make now. Waiting for the final forensic report leaves directors unable to meet their oversight duties during a critical period.

Question 23Core Competencies⚑ Flag

Developers at a logistics firm pull open-source libraries from public repositories with no review. A recent audit found several applications using components with known critical vulnerabilities and some with licenses that conflict with the firm's commercial products. Legal and engineering leaders ask the CISO for a plan. What is the BEST first step?

ATransfer the risk by buying a cyber insurance policy that covers open source BBan all open-source software until a full manual code review can be completed CAsk each developer to manually check every library against public databases DSet an open-source governance policy backed by automated composition analysis

Correct answer: D. Set an open-source governance policy backed by automated composition analysis
A governance policy, enforced with software composition analysis in the pipeline, addresses both vulnerable components and license conflicts at scale. A blanket ban is not business-aligned because modern development depends on open source, and it would halt delivery.

Question 24Core Competencies⚑ Flag

The board of a mid-sized hospital network asks the CISO how the organization would handle a major breach. The internal security team has four people and no forensic specialists. Which action would BEST prepare the organization within a limited budget?

AHire two full-time forensic analysts so investigations stay in house BArrange an IR retainer with agreed response times, engaged through outside counsel CBuy a forensic toolkit and train the current team to use it after hours DRely on the cyber insurer to choose a response firm for the company once a breach happens

Correct answer: B. Arrange an IR retainer with agreed response times, engaged through outside counsel
A pre-negotiated retainer gives fast access to specialists at predictable cost, and engaging the firm through counsel helps protect privilege. Waiting for the insurer to choose a firm during the crisis wastes critical hours and leaves the organization with no say in the terms.

Question 25Governance, Risk & Audit⚑ Flag

A CISO has ten minutes on the board agenda each quarter. Past reports listed blocked attacks, patch counts and malware detections, and directors said they could not tell whether the company was safer. What should the CISO change FIRST?

AAdd more detailed technical metrics so directors can see the full volume of security activity BAsk the board to extend the security agenda slot from ten minutes to thirty minutes each quarter CReport top risks against risk appetite, with trends and any decisions the board must make DReplace the written report with a live demonstration of the security operations center

Correct answer: C. Report top risks against risk appetite, with trends and any decisions the board must make
Boards need to understand risk posture in business terms, compared with the appetite they set, and know what decisions are required of them. More technical metrics or more time would not fix the core problem, which is that activity counts do not show risk.

Question 26Strategy, Finance & Vendors⚑ Flag

The CISO of Norvale Health is facilitating a SWOT analysis to inform the security strategy. The team has listed several findings. Which finding should be recorded as a weakness?

AStrong and visible support for the security program from the CEO BA new state privacy law that will raise board interest in security CA competitor that recently suffered a widely reported data breach DLimited in-house cloud security skills on the security team

Correct answer: D. Limited in-house cloud security skills on the security team
Weaknesses are internal factors that hold the organization back, and a skills gap on the team is internal. The new privacy law and the competitor's breach are external factors, so they belong under opportunities or threats.

Question 27Executive Leadership⚑ Flag

At Kestrel Manufacturing, the security team has detected signs that customer data may have been stolen. The CISO expects possible lawsuits and regulatory inquiries. Which step is MOST important before the investigation goes much further?

AHire a forensic firm directly using the security team's own budget BPost a short public statement to show the company is being open CEngage the general counsel so legal can guide the investigation DWipe and rebuild the affected servers to stop any further data loss

Correct answer: C. Engage the general counsel so legal can guide the investigation
Bringing in the general counsel early lets legal manage disclosure duties and, where appropriate, direct the investigation in a way that may protect privileged findings. Hiring a forensic firm directly is sensible work, but doing it without counsel can create legal exposure later.

Question 28Security Program & Operations⚑ Flag

Brightwater Financial must comply with PCI DSS, SOX and ISO/IEC 27001, and each has its own control team, test schedule and evidence requests. Business units complain that they answer nearly identical audit questions three times a year. The CISO wants to cut this burden without weakening compliance. What is the BEST approach?

ADrop the framework that carries the fewest regulatory penalties BBuild a common control set mapped to all three frameworks CAsk each business unit to name a full-time audit liaison DOutsource all three compliance programs to a single audit firm

Correct answer: B. Build a common control set mapped to all three frameworks
A common control framework maps each control once to every requirement it satisfies, so one test and one set of evidence can serve several obligations. This reduces business burden while keeping full coverage. Adding audit liaisons manages the symptom but keeps the duplicated testing in place.

Question 29Core Competencies⚑ Flag

A manufacturing company learns from a penetration test report that several domain administrator passwords are shared among staff and have not changed in years. The CEO asks the CISO to fix privileged access. Budget has been approved for a privileged access management solution. What should the CISO prioritize FIRST?

AForce an immediate password change on every account in the company during the next weekend BIssue a policy that bans the sharing of passwords and requires staff to sign an acknowledgment CDiscover and inventory all privileged accounts, their owners and the systems they can reach DDeploy session recording on every server so all administrator activity is captured going forward

Correct answer: C. Discover and inventory all privileged accounts, their owners and the systems they can reach
A privileged access program cannot protect accounts it does not know about, so discovery and ownership come first. Session recording is useful later, but without an inventory many privileged accounts would remain outside its coverage.

Question 30Governance, Risk & Audit⚑ Flag

Within a security policy framework, which document type sets mandatory, specific requirements, such as an approved encryption algorithm and minimum key length, that support a higher-level policy?

AA standard BA procedure CA policy statement DA guideline

Correct answer: A. A standard
Standards define mandatory, specific requirements, such as approved technologies and settings, that put a policy into effect. Guidelines are recommended rather than mandatory, and procedures describe step-by-step tasks.

Question 31Core Competencies⚑ Flag

An internal audit at a chain of coffee shops finds that the free guest Wi-Fi in each store runs on the same network as the point-of-sale terminals. The stores process card payments all day. The marketing team says the guest Wi-Fi is key to customer loyalty. What should be the CISO's GREATEST concern?

ACustomers may use too much bandwidth during busy hours BGuest devices can reach systems in the cardholder data environment CThe Wi-Fi password is printed on receipts and changed rarely DThe access points are a different brand than the corporate standard

Correct answer: B. Guest devices can reach systems in the cardholder data environment
Guest devices sharing a network with point-of-sale systems expose cardholder data and pull the guest network into PCI DSS scope. Bandwidth and password handling are lesser issues, and the fix is to isolate guest wireless rather than remove a feature the business values.

Question 32Core Competencies⚑ Flag

A retail company has rapidly exposed dozens of APIs to delivery partners and mobile apps. During a briefing, the CIO admits no one can say exactly how many APIs are live or who owns each one. The CISO is concerned about unauthorized data access through forgotten endpoints. What should the CISO do FIRST?

AEstablish an API inventory with named owners as part of an API governance process BOrder the development team to rewrite all APIs using a single new framework CShut down every partner API until each has passed a full penetration test DBuy a web application firewall and place it in front of all of the public-facing traffic

Correct answer: A. Establish an API inventory with named owners as part of an API governance process
You cannot protect, test or retire APIs you do not know about, so a governed inventory with accountable owners comes first. A firewall adds a useful layer, but it cannot cover unknown endpoints or fix weak authorization logic inside them.

Question 33Core Competencies⚑ Flag

At Pinehurst Apparel, an outside agency runs the company's social media accounts using shared passwords kept in a spreadsheet. A former agency employee recently posted offensive content from the main account, and it took a day to regain control. Marketing wants to keep using agencies. What is the BEST long-term fix?

ABring all posting in-house and stop using outside agencies entirely BChange the shared passwords monthly and email them to the agency CHold the accounts centrally with MFA and individual, revocable access DAdd a contract penalty for agency staff who misuse the company accounts

Correct answer: C. Hold the accounts centrally with MFA and individual, revocable access
Company-owned accounts managed through a central tool, with MFA and named user access, let the company remove one person's access at once and see who did what. Rotating shared passwords still leaves no individual accountability and depends on the agency handling secrets well.

Question 34Strategy, Finance & Vendors⚑ Flag

A CISO is building a business case for a data loss prevention program. The annualized loss expectancy for data leakage is $400,000. The program is expected to reduce that loss by 75% and will cost $120,000 per year. What is the return on security investment (ROSI)?

A250% B60% C75% D150%

Correct answer: D. 150%
The risk reduction is 75% of $400,000, which is $300,000. ROSI is ($300,000 minus $120,000) divided by $120,000, which equals 150%. The 250% option wrongly divides the full $300,000 reduction by the cost without subtracting the cost first.

Question 35Executive Leadership⚑ Flag

Internal audit at Brightwell Bank has issued a high-rated finding against the access review process. The CISO believes the rating overstates the risk because compensating controls exist. What is the BEST way for the CISO to respond?

AAccept the rating quietly to avoid conflict with the internal audit team BTell business units that the audit team does not understand security CAsk the CEO to have the finding removed before it reaches the audit committee DShare evidence of compensating controls and discuss the rating

Correct answer: D. Share evidence of compensating controls and discuss the rating
A constructive response gives audit the evidence and discusses the rating openly, which respects audit's independence and keeps the relationship strong. Asking the CEO to suppress the finding undermines audit's role and damages the CISO's credibility with the audit committee.

Question 36Governance, Risk & Audit⚑ Flag

A sales division asks to run a legacy CRM application that cannot meet the company's password standard. Replacing it will take about a year. The division head says the application is critical to revenue. What is the BEST way for the CISO to handle the request?

AProcess a formal exception with compensating controls, an expiry date and owner risk acceptance BApprove the request informally by email, since the application clearly supports critical company revenue CRewrite the corporate password standard so that the legacy application becomes compliant with it DDeny the request outright, because security standards must apply equally to every system in the company

Correct answer: A. Process a formal exception with compensating controls, an expiry date and owner risk acceptance
A formal exception process documents the risk, adds compensating controls, sets an end date and has the business owner accept the remaining risk. An outright denial ignores the business need, while informal approval leaves the risk undocumented and unmanaged.

Question 37Security Program & Operations⚑ Flag

During a quarterly review, the CISO of Tamsin Retail finds that access recertification for the finance system has been skipped for two cycles. The security team says finance owns the control, and finance says security owns it. No one is named in the control register. What should the CISO do FIRST?

AReport the finance department to the audit committee BAssign a named control owner and record it in the register CReplace the manual review with an automated access tool DHave the security team perform the reviews from now on

Correct answer: B. Assign a named control owner and record it in the register
Every control needs a named owner who is accountable for its operation and evidence. The gap exists because accountability was never assigned, so fixing ownership comes first. Having security quietly take over may restore the reviews but leaves the business owner of the data out of the decision.

Question 38Core Competencies⚑ Flag

A bank's access review shows that employees who change departments keep their old access and simply gain new access. Some long-tenured staff now hold rights across lending, treasury and operations. The CISO wants a lasting fix. What is the BEST solution?

AIncrease the frequency of user access reviews from yearly to monthly for all employees BRun a one-time cleanup project to remove excess access from all long-tenured employees CAsk managers to email the help desk whenever an employee joins their team from another unit DLink mover events in the HR system to automatic review and removal of prior access

Correct answer: D. Link mover events in the HR system to automatic review and removal of prior access
Driving access changes from authoritative HR mover events removes old rights at the time of transfer and stops privilege creep at its source. A one-time cleanup helps today, but creep would return because the process gap remains.

Question 39Core Competencies⚑ Flag

A midsize insurer has a three-person security operations team that already struggles to review EDR alerts. A vendor proposes an XDR platform that will add network, email and cloud telemetry. The CIO is ready to sign the contract this quarter. What should the CISO do FIRST?

AAsk the vendor to enable every available detection rule during the pilot phase BHire two more analysts after the XDR platform goes live next year CAssess whether the team can act on more telemetry or needs managed detection DSign the contract quickly to lock in the vendor's discounted pricing

Correct answer: C. Assess whether the team can act on more telemetry or needs managed detection
More telemetry adds value only if someone can triage and respond to it, so the CISO should first confirm operating capacity or plan for a managed detection and response service. Signing for a discount or turning on every rule would add noise to a team that is already overloaded.

Question 40Core Competencies⚑ Flag

A law firm's CISO learns that associates have been pasting client contract text into a free public generative AI chatbot to draft summaries. Partners like the productivity gains and do not want to lose them. Client confidentiality obligations are strict. What is the BEST course of action?

ALet each practice group decide on its own which AI tools are acceptable to use BIssue an AI acceptable use policy and provide an approved, contracted AI tool CWait for clear national AI regulation before taking any formal position on use DBlock all AI websites permanently at the firewall and warn staff about discipline

Correct answer: B. Issue an AI acceptable use policy and provide an approved, contracted AI tool
An acceptable use policy paired with an approved enterprise tool protects client data while keeping the business benefit partners value. A permanent block ignores the business need and usually drives use underground into even less visible shadow AI.

Question 41Core Competencies⚑ Flag

Ransomware has encrypted the order systems of a manufacturing company, and the attackers demand payment within 72 hours. The CEO calls the CISO and asks directly whether the company should pay. What should the CISO do?

AAdvise against paying, since payment funds crime and gives no guarantee BStart negotiating with the attackers to buy time while backups are tested CBring the decision to the crisis team under the approved policy, with legal review DRecommend paying at once, since every day of downtime costs the company more than the ransom

Correct answer: C. Bring the decision to the crisis team under the approved policy, with legal review
Ransom payment is a business decision for executive leadership, made under a pre-approved policy with legal review of sanctions and other obligations. The CISO supplies recovery options and risk information. Giving a personal yes or no, in either direction, goes beyond the CISO's authority.

Question 42Executive Leadership⚑ Flag

The CISO of Oakridge Retail wants to show executives that the awareness program is changing employee behavior, not just meeting a training requirement. Which measure would BEST show behavior change?

ARising rate of staff reporting suspicious emails, with faster reports BPercentage of staff who completed the annual awareness course on time CAverage score on the quiz at the end of the training module DNumber of awareness posters and newsletters released this year

Correct answer: A. Rising rate of staff reporting suspicious emails, with faster reports
An increasing and faster reporting rate shows that employees are acting on what they learned, which is real behavior change. Course completion only proves attendance and says little about how people act when a real threat arrives.

Question 43Governance, Risk & Audit⚑ Flag

A CISO is updating a security program built on NIST CSF 1.1 to version 2.0. Which change should the CISO highlight to executives as the main new element in the framework's core?

AA mandatory maturity tier that every organization must be certified against BA new Govern function covering strategy, policy, risk management and oversight CA new Detect function that replaces the older continuous monitoring categories DRemoval of the Recover function, which has now been merged into Respond

Correct answer: B. A new Govern function covering strategy, policy, risk management and oversight
NIST CSF 2.0 added Govern as a sixth function, covering strategy, expectations, policy, roles and risk management oversight. Detect and Recover remain functions, and the tiers are not a certification requirement.

Question 44Strategy, Finance & Vendors⚑ Flag

Kessler Manufacturing plans to replace its on-premises SIEM, which it bought outright with hardware and perpetual licenses, with a subscription-based SaaS SIEM. The CFO asks how this will change the way the cost appears in the budget. What is the BEST answer?

ASpending moves mostly from capital expense to operating expense BSpending moves mostly from operating expense to capital expense CSpending stays capital expense because the SIEM is a security asset DSpending becomes a one-time cost that no longer recurs each year

Correct answer: A. Spending moves mostly from capital expense to operating expense
Owned hardware and perpetual licenses are typically capital expenses, while subscriptions are recurring operating expenses. The tool still protects the business, but being a security asset does not make a subscription a capital expense.

Question 45Security Program & Operations⚑ Flag

The CISO of a payments company relies on an annual audit to confirm that key controls work. Last year, a firewall rule change disabled logging for seven months before the audit caught it. The board asks how such gaps will be found sooner. What is the BEST response?

AAssign an analyst to manually review all log sources daily BIncrease the audit frequency from annual to semiannual CImplement continuous monitoring of key controls DRequire dual approval for every future firewall rule change

Correct answer: C. Implement continuous monitoring of key controls
Continuous control monitoring uses automated checks to confirm that key controls keep operating, so failures surface in days rather than months. Dual approval may prevent some bad changes, but it does not detect a control that stops working for other reasons. Semiannual audits still leave long blind spots.

Question 46Core Competencies⚑ Flag

A healthcare system runs quarterly access recertifications, and managers approve over 99 percent of entries without changes. Many managers say the review lists are too long to understand. Regulators expect meaningful reviews. What should the CISO do to improve the program?

ADiscipline managers who approve access without changes so they take future reviews seriously BMove to risk-based reviews focused on sensitive access, with clear entitlement descriptions CTransfer all review duties to the security team because it understands entitlements best DShorten the review window from four weeks to one week so managers must act more promptly

Correct answer: B. Move to risk-based reviews focused on sensitive access, with clear entitlement descriptions
Focusing reviews on high-risk access and describing entitlements in business terms lets managers make real decisions. Moving reviews to the security team removes business accountability, since managers know what their staff actually need.

Question 47Executive Leadership⚑ Flag

The CISO of Lumen Pharma is rolling out multifactor authentication. Several senior executives ask to be exempted because they find it inconvenient, and staff are noticing. What is the GREATEST concern with granting these exemptions?

AIt will raise the help desk's workload for password resets BIt may break the single sign-on integration with cloud apps CIt requires the security team to keep a separate access policy DIt weakens tone at the top and makes controls look optional

Correct answer: D. It weakens tone at the top and makes controls look optional
When leaders exempt themselves, employees see security as optional, which undermines the culture the program depends on. Executives are also prime targets, so the exemption raises risk where it is highest. The extra policy maintenance is minor compared to this cultural damage.

Question 48Core Competencies⚑ Flag

The sales team at a software company wants to read corporate email and CRM data on their personal phones. Legal is worried about employee privacy and about wiping personal photos if a phone is lost. HR wants a policy that staff will accept. What is the BEST approach for the CISO to recommend?

AUse app-level containers with selective wipe, backed by a signed BYOD policy BBan personal devices and issue corporate phones to every member of sales CAllow access with no controls because the users are trusted employees DRequire full device enrollment so IT can wipe the entire phone remotely at any time

Correct answer: A. Use app-level containers with selective wipe, backed by a signed BYOD policy
Containerization or mobile application management protects corporate data and allows selective wipe without touching personal content, which addresses both security and privacy. Full device wipe on personal phones raises legal and employee relations problems, and a full ban may be costly and resisted.

Question 49Core Competencies⚑ Flag

A bank plans to launch a customer-facing generative AI assistant that can look up account details by querying internal systems. The board's risk committee asks the CISO to name the greatest security concern specific to this design. Which answer BEST fits?

ACustomers could prefer speaking with human agents over the AI assistant BCrafted user prompts could trick the assistant into revealing other customers' data CThe assistant's answers might use a writing tone that differs from the bank's official branding DThe cloud hosting provider could raise its monthly compute prices next year

Correct answer: B. Crafted user prompts could trick the assistant into revealing other customers' data
Prompt injection can manipulate a model that has access to internal data into bypassing intended limits and leaking sensitive records, which is a direct confidentiality and regulatory risk. Branding, pricing and customer preference matter to the business, but they are not security concerns.

Question 50Core Competencies⚑ Flag

During an active breach investigation at a financial services firm, a regulator calls the CISO directly. The regulator has heard rumors of an incident and asks for details. Facts are still being confirmed. What is the BEST response?

ADeny that any incident is under way until the investigation is complete BRefer the regulator to the forensic firm, which has the most technical detail CShare every finding to date so the regulator sees full transparency DAcknowledge the call and route it through legal and the designated contact

Correct answer: D. Acknowledge the call and route it through legal and the designated contact
Regulatory communications should go through legal counsel and the contact named in the IR plan, so statements are accurate, consistent, and meet reporting duties. Sharing unconfirmed findings may feel transparent, but it can give the regulator wrong information that is hard to correct later.

Question 51Governance, Risk & Audit⚑ Flag

A software company is preparing for ISO/IEC 27001:2022 certification. The project lead plans to leave several Annex A controls out of the Statement of Applicability without comment, because they seem irrelevant. What should the CISO direct the team to do?

ALeave the excluded controls out, since auditors only review included ones BReplace the Statement of Applicability with the risk register for the audit CImplement all 93 Annex A controls so that no exclusions are needed at all DList every Annex A control and justify each inclusion or exclusion

Correct answer: D. List every Annex A control and justify each inclusion or exclusion
The Statement of Applicability must cover the Annex A controls and justify why each is included or excluded, based on the risk treatment process. Implementing every control regardless of risk wastes resources and is not required by the standard.

Question 52Strategy, Finance & Vendors⚑ Flag

Midway through the fiscal year, the CFO of Orchard Retail tells the CISO that the security budget will be cut by 15%. Several funded projects have not started yet. The CISO believes the cut will increase risk. What should the CISO do?

AReprioritize by risk and have leadership accept the residual risk of what is cut BRefuse the cut and escalate it directly to the board as an urgent security emergency CCut every security project by 15% so the reduction is shared fairly DAsk business units to fund the security projects from their own budgets

Correct answer: A. Reprioritize by risk and have leadership accept the residual risk of what is cut
The CISO should protect the highest-risk work, defer lower-priority items, and make executives formally aware of and accept the risk created by the cut. An even 15% cut across all projects is tempting because it seems fair, but it ignores risk priority and can weaken critical controls.

Question 53Executive Leadership⚑ Flag

Tavira Group owns six business units in different countries, each with its own IT team and regulators. Corporate wants consistent security without slowing local decisions. Which organizational model for the security function is MOST suitable?

AOutsourcing all security work in every country to one global provider BA fully centralized team at headquarters running all security work CA federated model with central policy and local security leads DFully independent security programs inside each business unit

Correct answer: C. A federated model with central policy and local security leads
A federated model sets common policy, standards, and oversight centrally while local leads handle regional regulations and business needs. Full centralization would slow local decisions and miss country-specific requirements, which is the problem corporate wants to avoid.

Question 54Security Program & Operations⚑ Flag

A new CISO at Garnet Mutual finds that most security policies were last reviewed six years ago. Several refer to systems the company has retired and say nothing about cloud services, which now run most workloads. Auditors have started to question whether the policies are current. What should the CISO establish?

AA set review cycle with owners, plus reviews after major changes BA rule that each policy expires automatically after twelve months CA shift to technical standards only, dropping high-level policies DA rewrite of every policy by an outside firm in one large project

Correct answer: A. A set review cycle with owners, plus reviews after major changes
Named owners and a regular review schedule, with extra reviews when the business, technology or law changes, keep policies current over time. A one-time rewrite fixes today's gap, but the policies will drift out of date again without an ongoing cycle.

Question 55Core Competencies⚑ Flag

In a federated single sign-on arrangement between a company and a cloud service, which party is responsible for authenticating the user?

AThe service provider that hosts the cloud application BThe identity provider that the service provider trusts CThe certificate authority that issued the server certificate DThe network team that manages the company firewall rules

Correct answer: B. The identity provider that the service provider trusts
In federation, the identity provider authenticates the user and sends an assertion that the service provider trusts. The service provider relies on that assertion rather than authenticating the user itself.

Question 56Governance, Risk & Audit⚑ Flag

A fast-growing fintech has no documented risk appetite. Product teams complain that security reviews are inconsistent, with some risks blocked while similar ones are approved. The CISO wants to fix this at the root. Who should formally set the organization's risk appetite?

AThe CISO and the security team BThe board and senior leadership CThe internal audit department DEach product team for its own product

Correct answer: B. The board and senior leadership
Risk appetite is a strategic decision about how much risk the organization will take to pursue its goals, so the board and senior leadership set it. The CISO helps define and apply it but does not own that decision for the enterprise.

Question 57Core Competencies⚑ Flag

A university's endpoint patch compliance has been stuck at 68 percent for a year. Department heads complain that forced reboots disrupt research and teaching. The IT team applies the same deadline to every patch on every device. What is the MOST effective way for the CISO to improve this?

AForce immediate reboots on all devices whenever a patch is released BBuy a second patching tool to run alongside the current one on all campus devices CSet risk-based patch timelines and agree maintenance windows with departments DLet each department decide on its own whether to apply patches

Correct answer: C. Set risk-based patch timelines and agree maintenance windows with departments
Risk-based timelines focus effort on critical and exposed systems, and agreed maintenance windows reduce the business friction that drives resistance. Forced reboots worsen the conflict, a second tool does not fix the process, and leaving patching fully to departments removes accountability.

Question 58Core Competencies⚑ Flag

A hotel chain is about to buy thousands of smart thermostats, door locks and cameras for its properties. Facilities management is choosing vendors mainly on price. The CISO worries about devices that cannot be updated and ship with shared default passwords. What is the BEST way to reduce this risk?

ALet each hotel manager change the device passwords after installation is done BBuild minimum security requirements into the vendor selection and contracts CBuy extra cyber insurance to cover breaches that start from IoT devices DHave the SOC monitor the devices closely after they are deployed in each hotel

Correct answer: B. Build minimum security requirements into the vendor selection and contracts
Putting requirements such as unique credentials and guaranteed security updates into procurement prevents weak devices from entering the estate. Monitoring after deployment helps detect problems, but it cannot fix devices that were insecure by design.

Question 59Core Competencies⚑ Flag

A university recovered from a phishing-driven account takeover that exposed student records. The CIO wants to skip the post-incident review because the team is tired and the threat is gone. What is the CISO's BEST argument for holding the review?

AIt gives the forensic firm time to finish documenting its own findings BIt identifies the staff member who clicked the phishing link so that discipline can follow CIt is required before the cyber insurer will pay out on any claim DIt produces tracked improvement actions and a sound report for leadership

Correct answer: D. It produces tracked improvement actions and a sound report for leadership
A post-incident review finds root causes, assigns improvement actions with owners and dates, and gives leadership an accurate account of what happened. Focusing on blame discourages honest reporting and does not fix the process weaknesses behind the incident.

Question 60Executive Leadership⚑ Flag

At Corvane Telecom, critical vulnerabilities stay open for months. The infrastructure team says remediation belongs to security, and security says it belongs to infrastructure. What should the CISO do FIRST?

AAgree on a RACI that names one accountable owner for remediation BHave the security team patch the systems directly to close the gap CReport the infrastructure team to the CEO for failing to patch DBuy a new scanning tool with automatic ticket assignment

Correct answer: A. Agree on a RACI that names one accountable owner for remediation
The root cause is unclear ownership, and a RACI chart that names one accountable party fixes that at its source. Having security patch directly treats the symptom and takes on work that belongs to system owners, which tends to make the confusion worse.

Question 61Strategy, Finance & Vendors⚑ Flag

A CISO is comparing two email security products over three years. Product A costs $200,000 up front plus $100,000 per year for maintenance and staffing. Product B has no up-front cost, a subscription of $150,000 per year, and $20,000 per year in administration. Which product has the lower three-year total cost of ownership, and by how much?

AProduct A, by $90,000 BProduct B, by $10,000 CProduct A, by $10,000 DProduct B, by $50,000

Correct answer: C. Product A, by $10,000
Product A costs $200,000 plus 3 times $100,000, which is $500,000. Product B costs 3 times $170,000, which is $510,000, so Product A is lower by $10,000. Comparing only Product B's subscription against Product A's yearly costs leads to the wrong answer.

Question 62Governance, Risk & Audit⚑ Flag

After a risk assessment of a new customer portal, a moderate residual risk remains even with all planned controls in place. The project manager asks the CISO to sign the risk acceptance so the launch can proceed. What should the CISO do?

AHave the portal's business owner accept the residual risk, with the CISO advising BBlock the launch until additional controls reduce the remaining residual risk to zero CAsk internal audit to formally approve the residual risk before the portal goes live DSign the acceptance personally, since the CISO is accountable for every security risk in the company

Correct answer: A. Have the portal's business owner accept the residual risk, with the CISO advising
The business owner who benefits from the portal is accountable for its risk and should accept the residual risk, informed by the CISO's advice. The CISO signing it shifts business accountability to security, and internal audit must stay independent of risk decisions.

Question 63Security Program & Operations⚑ Flag

The CISO of Fennick Insurance has budget for only two of five proposed security projects this year. Each project lead argues that their project is the most urgent. The executive committee wants a clear rationale for the choice. What is the BEST basis for prioritizing?

AFund the projects that use the newest available technology BFund the projects with the lowest total cost first CFund the projects with the most vocal executive sponsors DRank projects by expected risk reduction per dollar

Correct answer: D. Rank projects by expected risk reduction per dollar
Ranking initiatives by the risk reduction they deliver relative to cost ties spending to the organization's risk appetite and gives executives a defensible rationale. Lowest cost is tempting, but cheap projects may address minor risks while major exposures stay untreated.

Question 64Core Competencies⚑ Flag

After reading about a breach at a competitor, a board member asks the CISO to buy a zero trust product this quarter. The organization has hybrid cloud systems and a large remote workforce. The CISO wants to respond in a way that builds lasting support. What is the BEST response?

AFrame zero trust as a strategy and propose a phased roadmap tied to critical assets and risk BAgree to buy a leading product now so the board sees fast action on its concern CExplain that zero trust needs no new spending because existing firewalls already meet it DAsk the network team to choose a vendor and report back after the purchase is complete

Correct answer: A. Frame zero trust as a strategy and propose a phased roadmap tied to critical assets and risk
Zero trust is an architecture and strategy, not a single product, so a phased roadmap tied to critical assets and business risk earns lasting support. Buying a product quickly may look responsive but rarely delivers zero trust outcomes.

Question 65Executive Leadership⚑ Flag

Fernhill Credit Union has 120 employees, growing regulatory duties, and no budget for a full-time CISO. The board wants experienced security leadership within the next quarter. What is the BEST option?

AGive the IT manager the CISO title and add security to the role BWait until revenue supports a full-time executive security hire CEngage a virtual CISO with clear scope and board reporting DRely on the external auditor to set security strategy each year

Correct answer: C. Engage a virtual CISO with clear scope and board reporting
A virtual CISO gives a small organization senior expertise at a fraction of the cost, and clear scope and reporting keep accountability visible. Giving the IT manager the title creates a conflict of interest and may not bring the needed leadership experience.

Question 66Core Competencies⚑ Flag

Under the cloud shared responsibility model, which responsibility remains with the customer whether the service is IaaS, PaaS or SaaS?

AMaintaining the operating system of managed services BPatching the hypervisor that hosts virtual machines CPhysical security of the provider's data centers DGoverning its data and who is allowed to access it

Correct answer: D. Governing its data and who is allowed to access it
In every cloud service model the customer stays accountable for its data, its classification and its identity and access management. Hypervisor patching and physical security belong to the provider, and the operating system of a managed service is also handled by the provider.

Question 67Core Competencies⚑ Flag

The head of supply chain at a food distributor wants to build a blockchain to track shipments, citing industry hype. Only the company's own internal teams would write to the ledger. The CEO asks the CISO for an opinion before funding the project. What should the CISO recommend FIRST?

ASelect a public cryptocurrency network to host the ledger at the lowest cost BReject the project because blockchain technology cannot be secured at all CApprove the project quickly so the company is seen as an industry innovator DAssess whether the use case truly needs decentralized trust over a database

Correct answer: D. Assess whether the use case truly needs decentralized trust over a database
Blockchain adds value mainly where multiple parties who do not trust each other must share a record, so a single-owner ledger may add cost and risk with no benefit. Rejecting it outright is not defensible, because the technology can be secured when the use case fits.

Question 68Core Competencies⚑ Flag

The CEO of an engineering firm asks the CISO to complete the business impact analysis personally, since the security team understands the systems best. Several business units have said they are too busy to help. What should the CISO do?

AComplete the BIA from system inventories and share it with the units for comment BHave business unit leaders own the impact ratings, with the CISO facilitating CDelegate the BIA to the IT operations team, which manages the infrastructure DPostpone the BIA until the units have time, and focus on technical recovery

Correct answer: B. Have business unit leaders own the impact ratings, with the CISO facilitating
Only business process owners can judge the financial, operational, and legal impact of losing their processes, so they must own the BIA inputs. A security-written draft shared for comment tends to reflect IT's view of what matters and rarely gets real business ownership.

Question 69Governance, Risk & Audit⚑ Flag

A retail chain's risk assessment shows that a large ransomware event could cause losses beyond what the company can absorb. Controls already reduce the likelihood, but the financial impact is still too high for the board's appetite. Which treatment BEST addresses the remaining financial exposure?

AMitigate further by adding a second endpoint tool BAccept the risk and document it in the risk register CTransfer part of the impact through cyber insurance DAvoid the risk by shutting down all online sales

Correct answer: C. Transfer part of the impact through cyber insurance
Cyber insurance transfers part of the financial impact to a third party, which directly addresses losses that exceed appetite. Acceptance is not appropriate when the exposure is beyond appetite, and another tool mainly targets likelihood rather than impact.

Question 70Strategy, Finance & Vendors⚑ Flag

Fenwick Bank wants to improve its third-party risk management with a new platform. The CISO is not sure what solutions exist, what features are common, or how vendors price them. The procurement team asks which document to issue first. What is the BEST choice?

AA request for quotation asking for firm pricing from vendors BA request for information to learn about the market CA purchase order with the best-known vendor in the space DA request for proposal with detailed technical requirements

Correct answer: B. A request for information to learn about the market
A request for information is used early to learn what the market offers when requirements are not yet clear. A request for proposal is tempting, but it works best after the organization knows enough to write solid requirements.

Question 71Security Program & Operations⚑ Flag

A CISO uses a CMMI-style maturity model to assess the incident management process. Procedures are documented, standardized across the organization and followed consistently. However, no quantitative performance data is collected or used to control the process. Which maturity level BEST describes this process?

ALevel 5, Optimizing BLevel 2, Managed CLevel 3, Defined DLevel 4, Quantitatively Managed

Correct answer: C. Level 3, Defined
In CMMI-style models, Level 3 (Defined) means processes are documented, standardized organization-wide and consistently followed. Level 4 requires the process to be measured and controlled with quantitative data, which is missing here.

Question 72Core Competencies⚑ Flag

A logistics company makes its CISO responsible for physical security at 12 warehouses after years of each site managing its own guards and locks. Theft incidents vary widely between sites. Leadership wants a consistent program within a year. What should the CISO do FIRST?

AHire a single guard company for all sites to lower costs and unify procedures BPerform a physical security risk assessment of each site to set priorities CWrite a corporate physical security policy and require each site to sign it DInstall the same camera system at every site to standardize evidence collection

Correct answer: B. Perform a physical security risk assessment of each site to set priorities
A risk assessment of each site shows threats, weaknesses and asset values, so spending goes where it reduces the most risk. Standardizing cameras first assumes the problem and solution before the risk is understood.

Question 73Executive Leadership⚑ Flag

Granite Health outsourced its 24x7 monitoring to a managed security service provider. After a missed alert led to a breach, an executive says the provider is responsible because monitoring was outsourced. What is the CISO's BEST response?

AAsk the provider's account manager to brief the board instead BAgree, because the contract moved the risk to the provider CExplain that the company keeps accountability for the outcome DRecommend ending the contract and bringing the SOC in-house

Correct answer: C. Explain that the company keeps accountability for the outcome
An organization can outsource tasks but not its accountability for protecting its data and meeting its legal duties. The contract may give financial remedies, but it does not move the regulatory and reputational responsibility, so agreeing with the executive would mislead leadership.

Question 74Core Competencies⚑ Flag

A media company has 60 cloud accounts, and developers can create resources freely. Last month a storage bucket holding customer files was left open to the internet. The CTO wants to keep developer speed high. What is the BEST long-term approach for the CISO?

AApply preventive guardrails as code plus continuous posture monitoring BRequire the security team to approve every new cloud resource by hand CRemove cloud console access from all developers until training is done DAsk developers to sign a pledge to check bucket settings before release

Correct answer: A. Apply preventive guardrails as code plus continuous posture monitoring
Preventive guardrails such as policy as code block risky settings automatically, and cloud security posture management catches drift without slowing developers. Manual approval of every resource creates a bottleneck, and removing access or relying on pledges does not scale.

Question 75Core Competencies⚑ Flag

Which type of threat intelligence is MOST suitable for informing the board and executive team about long-term risk trends and investment priorities?

AOperational intelligence about one imminent attack campaign BTechnical intelligence drawn from raw firewall log entries CTactical intelligence such as hashes and malicious IP lists DStrategic intelligence on threat trends and business impact

Correct answer: D. Strategic intelligence on threat trends and business impact
Strategic intelligence is high level and non-technical, focused on trends, motives and business impact, which suits executive decisions. Tactical intelligence such as indicators of compromise is meant for SOC analysts and security tools, not the boardroom.

Question 76Governance, Risk & Audit⚑ Flag

A CISO is evaluating a control for a customer database valued at $2,000,000. A breach would destroy 25% of its value, and one is expected every five years. The control costs $30,000 per year and would reduce the expected frequency to once every twenty years. What is the net annual value of the control?

A$45,000 B$70,000 C$75,000 D$25,000

Correct answer: A. $45,000
The single loss expectancy is $500,000, so the annual loss expectancy falls from $100,000 (ARO 0.2) to $25,000 (ARO 0.05), a reduction of $75,000. Subtracting the $30,000 annual cost gives a net value of $45,000. The $75,000 figure ignores the cost of the control.

Question 77Core Competencies⚑ Flag

At an online travel agency, IT has proposed a 24-hour recovery time objective for the booking platform because it fits the current backup design. The sales director says every hour offline loses significant revenue. How should the RTO be set?

AIT should set it, since it knows best what the current infrastructure can actually support BThe CISO should set it, since recovery is part of the security program CThe business owner should set it from impact data, with IT costing the options DThe DR vendor should set it based on what its service tier can guarantee

Correct answer: C. The business owner should set it from impact data, with IT costing the options
RTO reflects how long the business can tolerate an outage, so the business owner sets it using BIA data and weighs the cost options IT presents. Letting IT set it from current capability reverses the logic and can leave revenue-critical services badly underprotected.

Question 78Executive Leadership⚑ Flag

The CISO of Pinecrest Energy needs cloud security engineers within six months. The local market has few candidates, and salaries for the role have risen sharply. Which approach is MOST effective?

ARaise salary offers well above market for every open role BWait for the market to cool before starting any recruiting CLower the job requirements and hire whoever applies first DCombine targeted hiring with upskilling internal engineers

Correct answer: D. Combine targeted hiring with upskilling internal engineers
Blending external hiring with a plan to upskill current engineers closes the gap faster and builds loyalty and lasting capability. Paying far above market for every role strains the budget and does not solve the shortage if few candidates exist.

Question 79Security Program & Operations⚑ Flag

The board of Calder Energy asks the CISO for one metric that warns of rising exposure before an incident happens. The CISO currently reports the percentage of security projects delivered on time. Which metric BEST meets the board's request?

ATotal count of security tools deployed company-wide BNumber of security trainings completed this quarter CPercentage of security projects delivered on budget DTrend in overdue critical patches on key systems

Correct answer: D. Trend in overdue critical patches on key systems
A key risk indicator signals changes in exposure, and a growing number of overdue critical patches on key systems points to a rising likelihood of compromise. On-time or on-budget project delivery is a key performance indicator that measures execution, not exposure.

Question 80Core Competencies⚑ Flag

A CISO is reviewing emergency procedures for the company's main data center, which uses an automatic fire suppression system. Operations managers want staff to stay and power down servers safely during an alarm. What is the MOST important principle for the procedures?

AProtecting the most valuable hardware before any other action is taken BEnsuring staff evacuate safely before any effort to protect equipment CKeeping critical systems running until the backup site confirms takeover DCompleting an orderly shutdown so no data is lost during the event

Correct answer: B. Ensuring staff evacuate safely before any effort to protect equipment
Human safety always comes first in physical and environmental security, so procedures must put evacuation ahead of protecting assets. An orderly shutdown matters, but no data or hardware is worth risking a person's life.

Question 81Strategy, Finance & Vendors⚑ Flag

A CISO is leading the selection of a managed detection and response provider. Three vendors will respond to the request for proposal. A business unit leader already prefers one vendor because of a past relationship. What is the BEST way to keep the selection objective?

APick the vendor with the lowest price since all three meet the basics BAgree on weighted scoring criteria before the proposals are opened CAsk each vendor for a demo and choose the one the team liked best DLet the business unit leader choose since they will use the service

Correct answer: B. Agree on weighted scoring criteria before the proposals are opened
Weighted criteria agreed before proposals arrive make the evaluation consistent and defensible and reduce bias. Choosing on the lowest price alone ignores capability, security and risk factors that matter for a critical service.

Question 82Governance, Risk & Audit⚑ Flag

A payment processor passed its PCI DSS assessment three months ago. It then suffered a breach through a system outside the assessed cardholder data environment. A director asks how this could happen when the company was compliant. What is the BEST message for the CISO to give the board?

AThe breach was outside PCI scope, so it does not reflect on the security program BMore compliance frameworks should be added so that no system falls outside some audit scope CThe assessor missed the weakness, so the company should switch to a different assessor DCompliance is a minimum baseline, so the program must be driven by enterprise risk

Correct answer: D. Compliance is a minimum baseline, so the program must be driven by enterprise risk
Compliance covers specific scopes and minimum requirements, so it is a floor rather than a full measure of security. A risk-driven program protects the whole enterprise, while adding frameworks or blaming the assessor would not fix that gap.

Question 83Core Competencies⚑ Flag

A US health technology company is about to sign its first customers in the European Union. The CISO learns that its SaaS backup vendor replicates data to a region outside the EU. The sales team wants to close the deals this month. What should the CISO do FIRST?

AMove all backups to on-premises tape storage in the United States BTell sales to delay every EU deal until a new vendor is chosen CEngage legal and privacy to confirm transfer duties and review vendor terms DEncrypt all backups strongly and assume this alone meets every data residency requirement

Correct answer: C. Engage legal and privacy to confirm transfer duties and review vendor terms
Data residency and cross-border transfer rules are legal questions, so the CISO should first confirm obligations with legal and privacy and check what the vendor contract allows. Encryption alone may not satisfy residency rules, and stopping deals or moving backups is premature before the duties are known.

Question 84Core Competencies⚑ Flag

A healthcare CISO is preparing next year's budget request. Threat intelligence shows ransomware groups are increasingly targeting hospitals through remote access gateways. The CFO wants clear reasons for any new spending. What is the BEST way to use this intelligence?

AAsk for a budget increase matching the industry's average growth rate BMap the threat to control gaps and risks so funding targets the exposure CForward the raw intelligence reports to the CFO and let the data speak for itself DRequest funding for every product that vendors say stops ransomware

Correct answer: B. Map the threat to control gaps and risks so funding targets the exposure
Linking intelligence to specific gaps in the risk register turns threat data into a clear business case that ties spending to reduced exposure. Forwarding raw reports leaves the CFO to interpret technical material and does not explain what the money will fix.

Question 85Core Competencies⚑ Flag

Which type of continuity plan test carries the GREATEST risk to normal business operations?

ATabletop exercise BParallel test CFull interruption test DSimulation test

Correct answer: C. Full interruption test
A full interruption test actually shuts down primary operations and moves them to the recovery site, so a failure can cause a real outage. A parallel test brings up the recovery site while production keeps running, which lowers the risk considerably.

Question 86Executive Leadership⚑ Flag

SOC analysts at Meridian Freight work long shifts handling thousands of low-value alerts. Turnover has hit 40 percent, and the remaining staff report exhaustion. What should the CISO do FIRST?

AAddress alert fatigue through tuning, automation, and fair rotations BOffer a one-time retention bonus to all current SOC analysts CCut monitoring hours to business hours to reduce the workload DHire more junior analysts to spread the alert volume across more people

Correct answer: A. Address alert fatigue through tuning, automation, and fair rotations
Burnout here comes from noisy alerts and poor work design, so tuning, automation, and sensible rotations fix the root cause. A retention bonus may delay departures briefly, but people will still leave if the daily work stays the same.

Question 87Security Program & Operations⚑ Flag

Midway through a data loss prevention rollout, the head of sales asks the project manager to add coverage for a new cloud collaboration tool. The project manager agrees informally to keep the sponsor happy. The CISO notices that the schedule is starting to slip. What should the CISO do?

APause the project until sales agrees to fund the expansion BRoute the request through formal change control CReject the sales request to protect the original schedule DApprove the request and add staff to absorb the extra work

Correct answer: B. Route the request through formal change control
Scope changes should go through formal change control so their impact on schedule, cost and quality is assessed and approved by the sponsor. Rejecting the request outright may block a legitimate business need without any analysis of its value or risk.

Question 88Core Competencies⚑ Flag

A financial services firm is choosing a colocation facility for its secondary data center. The leading option offers the lowest price and is 15 miles from the primary site, in the same river flood plain. The CIO prefers it for easy staff travel. What is the CISO's GREATEST concern?

AA single regional event could disable both the primary and secondary sites BThe provider might not support the firm's preferred server hardware brand CThe facility may charge extra fees when the firm needs to add more rack space DStaff could face longer commutes if the firm later picks a more distant option

Correct answer: A. A single regional event could disable both the primary and secondary sites
A secondary site that shares the same flood risk as the primary site could fail at the same moment, which defeats its purpose. Cost and convenience matter, but they do not outweigh losing both sites to one regional event.

Question 89Governance, Risk & Audit⚑ Flag

A company is centralizing security logs from its offices in the United States, Germany and China into a single US-based platform. Regional managers warn that local laws may restrict moving some of that data abroad. What should the CISO do FIRST?

AEncrypt all logs in transit so that the transfer rules no longer apply BProceed with the platform, since US law governs a US-headquartered company CWork with legal counsel to map each country's data transfer requirements DCancel centralization and let each office run its own logging separately

Correct answer: C. Work with legal counsel to map each country's data transfer requirements
Before designing around conflicting multinational rules, the CISO needs legal counsel to identify what each jurisdiction actually requires. Encryption in transit does not remove data transfer obligations, and cancelling the project is premature before the requirements are known.

Question 90Strategy, Finance & Vendors⚑ Flag

The CISO of Aldridge Pharma is reviewing a contract with a cloud vendor that will store clinical trial data. The vendor's draft says it will notify the customer of a security incident within a commercially reasonable time. Aldridge has regulatory notice deadlines of its own. What is the GREATEST concern with this clause?

AIt does not name the vendor staff who will handle a security incident BIt does not let Aldridge choose the forensic firm used by the vendor CIt does not require the vendor to buy cyber insurance coverage DIt has no set timeframe, so Aldridge may miss its own notice duties

Correct answer: D. It has no set timeframe, so Aldridge may miss its own notice duties
Without a defined notice period, the vendor could delay telling Aldridge, which could cause Aldridge to miss its own regulatory deadlines. Cyber insurance is useful, but it does not fix the lack of timely notice.

Question 91Executive Leadership⚑ Flag

At Solano Aerospace, one senior engineer is the only person who understands the identity management platform and its integrations. The engineer has hinted at retiring next year. What is the CISO's BEST course of action?

AReplace the platform with a simpler product before the retirement BAsk the vendor to take over support once the engineer has left COffer a large bonus so the engineer agrees to stay several years DStart a succession plan with documentation and a trained backup

Correct answer: D. Start a succession plan with documentation and a trained backup
A succession plan that captures knowledge and develops a backup removes the key-person dependency in a planned way. A large bonus only delays the problem and leaves the organization exposed if the engineer leaves suddenly.

Question 92Core Competencies⚑ Flag

At a global consumer goods company, three business units have each adopted a different public cloud provider without central coordination. Each unit has its own small cloud team and tools. The CEO now wants a single view of cloud risk. What should be the CISO's GREATEST concern?

AInconsistent security policies and fragmented visibility across clouds BBusiness units may prefer different programming languages CSome providers release new services faster than others DEach provider charges different prices for storage, compute and data transfer

Correct answer: A. Inconsistent security policies and fragmented visibility across clouds
Uncoordinated multi-cloud use leads to uneven controls and blind spots, which prevents the single risk view the CEO wants. Pricing, programming languages and release speed matter to IT, but they are not the main security risk to the enterprise.

Question 93Core Competencies⚑ Flag

An energy utility's CISO wants to join the sector's Information Sharing and Analysis Center. General counsel worries that sharing incident details could expose the company to liability or reveal sensitive information. What is the BEST approach?

ADrop the idea because legal concerns outweigh any benefit of collective defense BCreate a sharing policy with legal that defines what is sanitized and approved CJoin but only receive information, and never share anything with other members DShare full incident reports, including customer names, to maximize their value

Correct answer: B. Create a sharing policy with legal that defines what is sanitized and approved
A policy agreed with legal sets clear rules on what can be shared, how it is sanitized and who approves it, which manages liability while gaining the benefit of collective defense. Receiving only is legal but weakens the community relationship and the value the utility gets over time.

Question 94Core Competencies⚑ Flag

The BIA at a property management company shows that its back-office accounting systems can tolerate an outage of up to 72 hours. Budget is tight, and the board wants a cost-effective recovery strategy. Which alternate site option BEST fits?

AA hot site with real-time replication kept fully up to date BA cold site with power and space but no installed equipment CA mobile recovery unit that can be shipped on short notice DA warm site with key hardware and connectivity ready in place

Correct answer: D. A warm site with key hardware and connectivity ready in place
A warm site balances cost and speed, and it can usually restore operations within a few days, which matches a 72-hour tolerance. A hot site would also meet the target, but it costs far more than the business impact justifies.

Question 95Governance, Risk & Audit⚑ Flag

Halvard Energy operates in the European Union and now falls under a cybersecurity law, similar to NIS2, that makes the management body accountable for cybersecurity risk measures. Board members assume this duty sits with the CISO alone. The CISO must help the company meet the law's governance expectations. What should the CISO recommend FIRST?

ABuy a compliance tool that maps each clause of the law to current controls BPurchase extra insurance that would cover fines imposed under the new law CHave the management body approve and oversee the measures, with training DAppoint the CISO to the board so the duty sits with a security expert

Correct answer: C. Have the management body approve and oversee the measures, with training
Laws of this kind expect the management body itself to approve cybersecurity risk measures, oversee how they are carried out and gain enough knowledge through training. A mapping tool supports compliance work, but it does not meet the requirement that leadership own these decisions.

Question 96Security Program & Operations⚑ Flag

A SIEM replacement project has a planned value of $500,000, an earned value of $400,000 and an actual cost of $320,000 at the latest review. The steering committee asks the CISO for a status summary. Which summary is accurate?

AUnder budget and behind schedule BUnder budget and ahead of schedule COver budget and ahead of schedule DOver budget and behind schedule

Correct answer: A. Under budget and behind schedule
CPI equals EV divided by AC, or $400,000 / $320,000 = 1.25, so the project is under budget. SPI equals EV divided by PV, or $400,000 / $500,000 = 0.8, so less work is complete than planned and the project is behind schedule.

Question 97Core Competencies⚑ Flag

A US technology company is opening offices in Germany and Brazil. The CISO proposes that every new hire worldwide receive the same deep background check, including credit and criminal history. HR warns that local rules differ. What is the BEST approach?

ALet each local office manager decide which checks to run for their new hires BApply the US screening standard everywhere so that all employees are treated equally CWork with HR and legal to set role-based screening levels that follow local laws DSkip background checks outside the US until each country passes clear guidance

Correct answer: C. Work with HR and legal to set role-based screening levels that follow local laws
Screening should match the risk of each role and must follow local employment and privacy laws, which HR and legal can interpret. Applying one US standard everywhere could break local law and expose the company to legal action.

Question 98Executive Leadership⚑ Flag

The CISO of Westbury College plans to block personal cloud storage on staff devices. Faculty leaders strongly oppose it and say it will disrupt research collaboration. What is the BEST approach to manage this resistance?

AInvolve faculty early and offer an approved alternative BDrop the control because faculty support is important to the college CRoll out the block on schedule and handle complaints afterward DAsk the president to order faculty to comply with the change

Correct answer: A. Involve faculty early and offer an approved alternative
Engaging the people affected, understanding their needs, and offering a sanctioned alternative reduces resistance and protects data at the same time. Forcing the change through an order may get compliance on paper but often drives people to riskier workarounds.

Question 99Strategy, Finance & Vendors⚑ Flag

Larkspur Media has more than 600 vendors and a third-party risk team of two people. The CISO has been asked to assess vendor risk across the whole portfolio. What is the BEST approach?

AAssess only the vendors with the largest annual contract values BTier vendors by data access and criticality and match review depth to tier CHire an outside firm to perform on-site audits of every single vendor DSend the same detailed questionnaire to all 600 vendors every year

Correct answer: B. Tier vendors by data access and criticality and match review depth to tier
Risk tiering focuses limited staff on vendors that handle sensitive data or support critical services, with lighter reviews for low-risk vendors. Using contract value alone is tempting, but a cheap vendor can still have deep access to sensitive data.

Question 100Core Competencies⚑ Flag

A payments startup stores customer data in a public cloud using encryption keys fully managed by the cloud provider. A large bank customer now requires a contract clause giving the startup the ability to revoke access to the bank's data at any time. The CEO wants to win the deal. What is the BEST approach for the CISO?

AMove to customer-managed keys in an HSM-backed KMS with set custody rules BStore the encryption keys in a password-protected spreadsheet kept by the finance team CDisable encryption so the data can be deleted faster when needed DKeep provider-managed keys and add the clause to the contract anyway

Correct answer: A. Move to customer-managed keys in an HSM-backed KMS with set custody rules
Customer-managed keys backed by a hardware security module let the company control rotation and revocation, with clear custody and separation of duties. Signing a clause it cannot meet creates legal risk, and keeping keys in a spreadsheet or dropping encryption weakens protection.

Question 101Governance, Risk & Audit⚑ Flag

During a reorganization, the CEO proposes having the internal audit team report to the CISO so that security and audit work more closely. The CISO likes the idea of more resources. What is the GREATEST concern?

AExternal auditors might charge higher fees for the next annual audit BThe CISO would need to learn audit standards before managing the audit team CInternal audit would lose its independence when reviewing security controls DAudit staff would need new security certifications to stay in their roles

Correct answer: C. Internal audit would lose its independence when reviewing security controls
Internal audit must be independent of the functions it reviews and should report to the audit committee. If it reported to the CISO, it could not objectively assess the security program, which outweighs any training or fee concerns.

Question 102Core Competencies⚑ Flag

A manufacturing company has hired an outside firm to run its first external penetration test. The testers are ready to start Monday. The CISO realizes that only an email thread describes what will be tested. What should the CISO ensure is in place BEFORE testing begins?

AA promise from the testers that they will find at least ten vulnerabilities BA signed rules of engagement with scope, timing and written authorization CA press release announcing that the company is testing its own defenses DA full list of every employee password so testers can work more quickly

Correct answer: B. A signed rules of engagement with scope, timing and written authorization
Signed rules of engagement define scope, limits, timing and contacts, and they give the legal authorization that separates a test from an attack. Sharing employee passwords would create a serious security exposure and is never a prerequisite for testing.

Question 103Core Competencies⚑ Flag

A health insurer depends on one SaaS provider for claims processing, and no alternative is in place. The provider recently had a two-day outage that stopped all claims payments. What should the CISO recommend FIRST to address this risk?

ABuild an in-house claims platform so the insurer controls its own availability BBuy business interruption insurance to cover losses from future vendor outages CTerminate the contract and move to a provider with a better uptime record DInclude the dependency in continuity plans and get the vendor's recovery evidence

Correct answer: D. Include the dependency in continuity plans and get the vendor's recovery evidence
The first step is to treat the vendor as a critical dependency, review its continuity and recovery capabilities, and plan workarounds or alternates. Terminating the contract right away is premature and may only swap one single point of failure for another.

Question 104Executive Leadership⚑ Flag

Halvorsen Corp has just acquired a competitor that has its own security team, tools, and policies. The CISO of the combined company has been asked to integrate the two teams. What should the CISO do FIRST?

AAssess the acquired team's people, controls, and risks BReplace the acquired team's tools with the parent company's tools CMerge the two teams into one structure during the first week DLet both teams keep operating separately for the next few years

Correct answer: A. Assess the acquired team's people, controls, and risks
A clear assessment of people, controls, risks, and culture gives the CISO a sound basis for integration decisions. Replacing tools right away may remove capabilities the parent lacks and can alienate the acquired staff before their value is understood.

Question 105Security Program & Operations⚑ Flag

A mid-sized online retailer has two security analysts working business hours and no budget to hire ten more. Attacks often happen at night and on weekends. The CFO wants round-the-clock coverage at a predictable cost. What is the BEST option for the CISO to propose?

AA monitoring scope that is limited to business hours only BA hybrid model with an MSSP for after-hours monitoring CA fully in-house 24x7 SOC built over the next two years DAlerts routed to the analysts' phones outside business hours

Correct answer: B. A hybrid model with an MSSP for after-hours monitoring
A hybrid model keeps internal staff for business context and escalations while an MSSP provides 24x7 monitoring at a predictable cost. Routing alerts to phones keeps costs low but leads to fatigue, slow response and burnout for a two-person team.

Question 106Core Competencies⚑ Flag

An internal audit at a distribution company finds that two accounts payable clerks can both create new vendors and approve payments to them. The finance director says the team is too small to split duties fully. What should the CISO recommend?

AAssign vendor setup and payment approval to different people, with reviews if needed BReplace both clerks with new staff who have passed more thorough background checks CRequire the clerks to sign a yearly statement confirming they have not committed fraud DAccept the finding because small teams cannot be expected to separate any duties

Correct answer: A. Assign vendor setup and payment approval to different people, with reviews if needed
Separating vendor setup from payment approval prevents one person from creating and paying a fake vendor, and detective reviews can compensate where staff are limited. Accepting the finding leaves a well-known fraud path open.

Question 107Strategy, Finance & Vendors⚑ Flag

During a review of a critical payroll provider, the CISO of Westbrook University learns that the provider stores all payroll data with a hosting subcontractor that Westbrook has never assessed. The payroll provider's contract does not mention subcontractors. What should the CISO do?

AContact the hosting subcontractor directly and demand an on-site audit BTerminate the payroll contract as soon as a replacement is found CAccept the risk since the payroll provider is responsible for its suppliers DRequire disclosure of key subcontractors and flow-down of security terms

Correct answer: D. Require disclosure of key subcontractors and flow-down of security terms
Fourth-party risk is best handled by making the vendor disclose key subcontractors and pass equal security duties down to them by contract. Westbrook has no contract with the subcontractor, so demanding an audit directly is outside its authority.

Question 108Governance, Risk & Audit⚑ Flag

An internal audit report rates a finding as high: privileged accounts in the ERP system are never reviewed. The CISO agrees with the finding and must submit a management response. What should the response include?

AA corrective action plan with a named owner and a target completion date BA full technical design for a new privileged access management system CA statement accepting the finding, with remediation left to the IT team's discretion DA request that the finding be downgraded because no breach has occurred yet

Correct answer: A. A corrective action plan with a named owner and a target completion date
A management response should commit to specific corrective actions, with an accountable owner and a due date that audit can track. Accepting the finding without a plan leaves no accountability, and a detailed technical design is more than the response needs.

Question 109Executive Leadership⚑ Flag

The CEO of Rosewood Travel learns that customer payment data was exposed and tells the CISO to hold off on any breach notification until after the quarterly earnings call. The law requires timely notice. What should the CISO do?

ANotify regulators directly without telling anyone inside the company BDelay notice but keep detailed private notes in case of an inquiry CExplain the legal duty and escalate through counsel and the board DFollow the CEO's direction, since the CEO has the final authority

Correct answer: C. Explain the legal duty and escalate through counsel and the board
The CISO must not take part in breaking notification laws, so the right step is to explain the legal duty and escalate through the general counsel and the board. Going straight to regulators skips internal governance that may resolve the issue quickly and lawfully.

Question 110Core Competencies⚑ Flag

The board of a pension fund read that future quantum computers may break today's public key encryption. Some of the fund's member records must stay confidential for decades. The board asks the CISO what the organization should do now. What should the CISO do FIRST?

ABuild an inventory of where cryptography is used and protects long-lived data BAsk each vendor to confirm in writing that it is quantum safe CReplace all encryption with new post-quantum algorithms this year DWait until quantum computers are proven to work before spending any security budget

Correct answer: A. Build an inventory of where cryptography is used and protects long-lived data
A cryptographic inventory shows which systems and long-lived data are most exposed, including to harvest now, decrypt later attacks, and it supports crypto agility planning. Replacing everything at once is premature and risky, while waiting ignores data that must stay secret for decades.

Question 111Core Competencies⚑ Flag

A telecom company's vulnerability scanners report over 40,000 open findings. IT teams say they cannot fix everything and are working through the list oldest first. The CISO must set a remediation approach the board can support. What is the BEST approach?

AStop scanning until IT has the staff to keep up with the current workload BKeep fixing findings in date order until the full backlog is cleared out CRequire every finding to be fixed within seven days no matter the severity DSet remediation timeframes based on risk, exploitability and asset value

Correct answer: D. Set remediation timeframes based on risk, exploitability and asset value
Risk-based remediation timeframes focus limited staff on the flaws most likely to be exploited on the most important assets. A single seven-day deadline for everything sounds strict, but it is unrealistic and spreads effort evenly instead of where risk is highest.

Question 112Core Competencies⚑ Flag

The CFO of a pharmaceutical company complains that every internal investigation costs too much because evidence must be hunted down after the fact, and some logs have already been overwritten. Which initiative would BEST address this?

ATrain all system administrators to image any device they suspect has been involved in a case BBuild a forensic readiness program defining evidence sources and retention CSwitch all investigations to an outside forensic firm with set fees DBuy forensic imaging tools for every regional IT support office

Correct answer: B. Build a forensic readiness program defining evidence sources and retention
Forensic readiness plans ahead which evidence is needed, how long it is kept, and how it is collected, which lowers investigation cost and improves the quality of evidence. Outsourcing the work does not fix logs that were never captured or were already overwritten.

Question 113Security Program & Operations⚑ Flag

A CISO reports mean time to detect (MTTD) to the executive team. What does this metric measure?

AAverage time for a vendor to release a security patch BAverage time for analysts to close a ticket after triage CAverage time from incident start until it is identified DAverage time from detection until the incident is resolved

Correct answer: C. Average time from incident start until it is identified
MTTD measures the average time between when an incident begins and when the organization discovers it, and shorter MTTD limits attacker dwell time. The time from detection to resolution is captured by mean time to respond or recover (MTTR), which is a separate metric.

Question 114Core Competencies⚑ Flag

What is the PRIMARY security purpose of a mandatory vacation policy for employees in sensitive positions?

ATo lower burnout so that employees make fewer configuration errors at work BTo expose fraud or misuse that relies on the employee's continuous presence CTo give the organization time to complete yearly access recertification work DTo meet labor law requirements on paid time off in most US jurisdictions

Correct answer: B. To expose fraud or misuse that relies on the employee's continuous presence
Mandatory vacation forces someone else to perform the duties for a period, which can reveal fraud that the absent employee was hiding. Reducing burnout is a benefit, but it is not the main security reason for the control.

Question 115Governance, Risk & Audit⚑ Flag

A CISO is reviewing a cloud payroll vendor before signing a contract. The vendor offers a SOC 2 Type I report dated last month. The CISO needs assurance that the vendor's controls have actually worked over time. What should the CISO request?

AThe vendor's latest internal penetration test summary BA signed letter from the vendor's CEO attesting to controls CA SOC 1 Type I report on financial reporting controls DA SOC 2 Type II report covering a recent review period

Correct answer: D. A SOC 2 Type II report covering a recent review period
A SOC 2 Type II report tests whether controls operated effectively over a period, while Type I only covers design at a point in time. A SOC 1 report focuses on financial reporting and is still point in time if it is Type I.

Question 116Executive Leadership⚑ Flag

While preparing for an external audit, the CISO of Dunmore Industries finds evidence that the CFO altered access review records to hide missed reviews. The CFO is a close ally of the CEO. What is the BEST action?

AConfront the CFO privately and ask that the records be fixed BReport it to the audit committee or formal ethics channel CFix the records quietly so the audit can go ahead as planned DIgnore it, since access reviews are the CFO's own responsibility

Correct answer: B. Report it to the audit committee or formal ethics channel
Falsified audit evidence by a senior officer should go to the audit committee or a protected ethics channel, which exist for cases where executives may be conflicted. A private confrontation may lead to evidence being destroyed and leaves the CISO exposed without formal protection.

Question 117Strategy, Finance & Vendors⚑ Flag

The CFO of Brannock Distribution wants to renew cyber insurance with the carrier offering the lowest premium. The CISO's top loss scenarios are ransomware downtime and an outage at a key cloud provider. The cheapest policy has a low sublimit for ransomware and excludes losses caused by third-party provider outages. What is the GREATEST concern?

AThe carrier's response panel may not include the current IR firm BThe premium may rise sharply next year after any claim is filed CThe policy terms do not cover the company's most likely losses DThe insurer may require a new security questionnaire every year

Correct answer: C. The policy terms do not cover the company's most likely losses
Insurance only transfers risk when its coverage, sublimits and exclusions match the organization's main loss scenarios, so a cheap policy that excludes them leaves most of the exposure in place. A limited panel of response firms is an inconvenience, but it matters far less than the core losses going uncovered.

Question 118Core Competencies⚑ Flag

An online travel agency's customer booking portal went down for six hours because a TLS certificate expired. It is the second outage of this kind this year. Certificates are bought and installed by whichever team needs them. What is the BEST action for the CISO to take?

ASet up a central certificate inventory with owners and automated renewal BBuy certificates with the longest validity period available CDiscipline the team responsible for the expired certificate and record it as a policy breach DAsk each team to add certificate renewal dates to their calendars

Correct answer: A. Set up a central certificate inventory with owners and automated renewal
A central inventory with clear ownership, monitoring and automated renewal fixes the root cause of unmanaged certificate lifecycles. Longer validity periods are capped by industry rules and only delay the problem, while blame and calendar reminders do not scale.

Question 119Core Competencies⚑ Flag

A university's red team regularly breaches systems during exercises, but its final reports arrive months later. The blue team says it learns little because it never sees the techniques used in real time. Detection capability has barely improved in two years. What should the CISO do?

AHire a second red team to confirm the findings of the first red team BAsk the blue team to write longer reports on their incident responses CDisband the red team since its slow reports have not improved detection at all DRun purple team exercises where both teams work together on detections

Correct answer: D. Run purple team exercises where both teams work together on detections
Purple teaming brings attackers and defenders together so each technique is tested, observed and turned into better detection right away. Disbanding the red team throws away a useful capability when the real problem is the lack of collaboration and feedback.

Question 120Core Competencies⚑ Flag

At a commercial bank, several system administrators passed around a hard drive from a suspected fraud case without recording who handled it. The bank now expects to pursue legal action. What is the CISO's GREATEST concern?

AThe evidence may be inadmissible without a documented chain of custody BThe bank may need to buy new forensic hardware for later cases CThe drive may have become corrupted through repeated handling DThe administrators lacked formal training in forensic analysis and evidence handling

Correct answer: A. The evidence may be inadmissible without a documented chain of custody
Without a documented chain of custody, opposing counsel can challenge the integrity of the evidence, and a court may give it little weight or exclude it. Lack of training is a real gap, but the immediate business risk is losing the evidence for the legal case.

Question 121Governance, Risk & Audit⚑ Flag

A state banking regulator notifies a bank that it will conduct a cybersecurity examination in 60 days. The CISO joined the bank four months ago. What should the CISO do FIRST?

AHire an outside firm to answer the examiners' questions on the bank's behalf BRush to deploy new security tools so the exam shows recent investment CReview prior exam findings and their remediation status, and organize evidence DAsk the regulator to postpone the exam until the CISO has a full year in role

Correct answer: C. Review prior exam findings and their remediation status, and organize evidence
Examiners usually start with prior findings, so the CISO should confirm remediation status and organize evidence of the program. Hastily deploying tools adds risk and does not show sustained control, and the bank must answer for itself.

Question 122Security Program & Operations⚑ Flag

The SOC manager at Delvin Bank proposes buying a SOAR platform to cut analyst workload. Current triage steps differ by analyst and are not written down. The CISO supports automation but wants the investment to succeed. What should the CISO require FIRST?

AA proof of concept with every SOAR vendor on the market BA cut in analyst headcount to help fund the platform CIntegration of the SOAR tool with every existing security tool DDocumented, standardized playbooks for common alerts

Correct answer: D. Documented, standardized playbooks for common alerts
Automation only scales a process that is already defined, so standardized playbooks must exist before SOAR can deliver value. Automating inconsistent steps produces inconsistent results faster. Integrating every tool first is premature and costly when the workflows themselves are not settled.

Question 123Core Competencies⚑ Flag

After a former engineer took design files to a competitor, the CEO of a defense supplier asks the CISO to launch an insider threat program. Employees are already uneasy about workplace monitoring. What should the CISO do FIRST?

AAnnounce a zero-tolerance policy and require all staff to accept full monitoring BReview the email and file activity of every engineer for the past two years CDeploy user behavior analytics on all endpoints to begin collecting baseline data DForm a governance group with HR, legal and privacy to define scope and safeguards

Correct answer: D. Form a governance group with HR, legal and privacy to define scope and safeguards
An insider threat program needs HR, legal and privacy involvement from the start to set its scope, legal limits and employee protections. Deploying monitoring tools first risks legal problems and could damage trust before any rules exist.

Question 124Executive Leadership⚑ Flag

Under widely cited US corporate law precedent such as the Caremark decision, what duty do directors have regarding risks like cybersecurity?

AA duty to guarantee that the company never suffers a data breach BA good-faith duty to ensure an oversight and reporting system exists CA duty to hold a technical security certification while on the board DA duty to personally approve every security control and tool purchase

Correct answer: B. A good-faith duty to ensure an oversight and reporting system exists
Caremark and later cases describe a duty of oversight, meaning directors must make a good-faith effort to ensure reporting systems exist and to act on red flags. No legal standard requires directors to guarantee zero breaches or approve every control.

Question 125Strategy, Finance & Vendors⚑ Flag

An internal audit at Coastal Utilities finds that most critical vendors were assessed once during onboarding, some more than three years ago, and never reviewed again. Two of those vendors have since changed hosting providers. What should the CISO do?

AReassess every vendor in the portfolio immediately with a full audit BWait for vendors to report changes since contracts require notice CEstablish ongoing monitoring with review frequency based on vendor tier DMove the critical services back in-house to remove the vendor risk

Correct answer: C. Establish ongoing monitoring with review frequency based on vendor tier
Vendor risk changes over time, so ongoing monitoring with frequency set by risk tier keeps assessments current. Relying on vendors to report changes is tempting, but the audit already shows that changes happened without the organization reassessing them.

Question 126Governance, Risk & Audit⚑ Flag

An external auditor is planning the annual IT general controls audit. The CFO asks the CISO to persuade the auditor to remove the identity management system from scope because a recent migration left gaps. What should the CISO do?

AAgree, but fix the gaps quietly before the auditor's fieldwork begins BDecline, and ask internal audit to run a separate review in its place CAgree, and ask the auditor to defer the system until next year's audit DDecline, and disclose the known gaps along with the remediation plan

Correct answer: D. Decline, and disclose the known gaps along with the remediation plan
Audit scope belongs to the auditor, and trying to hide known weaknesses undermines audit integrity and trust. Disclosing the gaps with a remediation plan shows management is in control, while a substitute internal review does not replace the external audit.

Question 127Core Competencies⚑ Flag

After a departing engineer emailed design files to a personal account, the board of a manufacturing firm asks the CISO to roll out data loss prevention quickly. A vendor offers to deploy its DLP tool across all endpoints within a month. Business units have not defined which data is sensitive. What should the CISO do FIRST?

ARequire every employee to sign a new confidentiality agreement BDeploy the DLP tool in blocking mode on every endpoint right away to stop leaks CWork with data owners to classify sensitive data and set handling rules DBlock all personal email and cloud storage sites at the web proxy

Correct answer: C. Work with data owners to classify sensitive data and set handling rules
DLP rules are only as good as the data classification and business handling rules behind them, so data owners must define what is sensitive first. Deploying a tool in blocking mode without that groundwork causes false positives and business disruption.

Question 128Core Competencies⚑ Flag

After hearing about a competitor's program at a conference, a board member urges the CISO to launch a public bug bounty next month. The company's internal vulnerability management is immature, and patching backlogs are long. What should the CISO advise?

ALaunch the public bounty right away to show the board strong leadership BMature internal remediation first, then start with a private bounty program CRefuse any form of external research because outsiders cannot be trusted DOffer the largest rewards in the industry to attract the best researchers

Correct answer: B. Mature internal remediation first, then start with a private bounty program
A public bounty can produce a flood of reports that an immature program cannot triage or fix, which wastes money and leaves known flaws open. A phased approach starting private after internal processes improve is safer, while refusing all outside research gives up a valuable source of findings.

Question 129Executive Leadership⚑ Flag

At 2 a.m., ransomware is spreading across file servers at Quillon Media. The CISO has incomplete information about the entry point, and isolating the network will halt live broadcasts. What is the BEST approach?

ALeave the network running to protect broadcast revenue for the night BAsk the SOC analysts on shift to vote on whether to isolate the network CMake a timely containment call with crisis leads, then adjust DWait for full forensic details before making any containment decision

Correct answer: C. Make a timely containment call with crisis leads, then adjust
Crisis leadership means making a timely, defensible decision with the right stakeholders using the best information available, then adjusting as facts emerge. Waiting for complete forensics lets the ransomware keep spreading while the cost of delay grows.

Question 130Core Competencies⚑ Flag

SIEM storage costs at an e-commerce company have doubled, and the security operations manager proposes cutting log retention to 30 days. The company handles cardholder data and has had investigations that reached back several months. What should the CISO do?

ABase retention on legal, regulatory, and investigative needs, using tiered storage BKeep every log in the SIEM indefinitely so no evidence is ever lost CLet each system owner decide how long to keep logs for their platform DApprove the 30-day limit, since most attacks are found within the first month anyway

Correct answer: A. Base retention on legal, regulatory, and investigative needs, using tiered storage
Retention should follow legal, regulatory, and investigative requirements, and cheaper archive tiers can hold older logs at lower cost. Cutting to 30 days would likely breach payment card requirements and would undermine investigations that often start months after the initial compromise.

Question 131Security Program & Operations⚑ Flag

The security engineering lead at Ridley Freight proposes replacing a commercial vulnerability management platform with an open-source tool to save $180,000 a year in licenses. The team has two engineers, and neither has run the open-source tool before. The CFO likes the savings. What should the CISO evaluate MOST carefully before deciding?

AWhether the open-source license allows changes to the code BThe full cost, including staff time, support and upkeep CHow many peer companies have already adopted the same tool DWhether the current vendor will offer a renewal discount

Correct answer: B. The full cost, including staff time, support and upkeep
Open-source tools remove license fees but shift setup, maintenance, upgrades and support onto the organization, and for a small team that effort can exceed the savings. License terms matter, but they rarely decide whether the tool is affordable and sustainable for this team.

Question 132Core Competencies⚑ Flag

Cobalt Insurance is closing its last on-premises data center after moving to the cloud. A recycling firm has offered to remove all servers and storage arrays for free and resell them. The facilities manager wants to sign this week to meet the lease end date. What should the CISO require MOST?

AVerified sanitization or destruction of all media, with certificates BA full image backup of every server before the equipment is removed CA share of the resale price paid back to the company under the deal DA lease extension so the data center can stay as a spare recovery site

Correct answer: A. Verified sanitization or destruction of all media, with certificates
Retired storage can still hold sensitive data, so drives must be wiped to a recognized standard or physically destroyed, with chain of custody and certificates of destruction, before equipment leaves the company's control. Imaging every server is unnecessary after migration and only creates more copies of data that then need protection.

Question 133Governance, Risk & Audit⚑ Flag

A marketing team plans to launch a loyalty app that tracks customer location to send personalized offers. The app will process personal data of EU residents. The project is two months from launch. What should the CISO recommend FIRST?

AAdd a privacy notice to the app store listing and proceed as planned BEncrypt the location data at rest and in transit before the launch CComplete a data protection impact assessment with the privacy officer DDelay the launch until the app passes an external penetration test

Correct answer: C. Complete a data protection impact assessment with the privacy officer
Location tracking for profiling is likely high-risk processing under GDPR, which calls for a data protection impact assessment before launch. Encryption is useful but addresses only one control and does not establish whether the processing is lawful and proportionate.

Question 134Executive Leadership⚑ Flag

The CFO of Northgate Utilities asks the CISO to express cyber risk the same way other enterprise risks are reported. Which approach does a quantification method such as FAIR support?

AScoring each risk with technical severity scores from scanners BCounting the number of open audit findings for each system CRating each risk only as high, medium, or low on a heat map DEstimating probable loss ranges from frequency and magnitude

Correct answer: D. Estimating probable loss ranges from frequency and magnitude
FAIR estimates loss event frequency and loss magnitude to express risk as ranges of probable financial loss, which matches how the CFO reports other risks. Heat maps are common but give ordinal ratings that cannot be compared directly with financial exposures.

Question 135Strategy, Finance & Vendors⚑ Flag

A CISO is adapting the balanced scorecard to report on the security program. One proposed measure is the percentage of security staff who completed planned skills training this year. Under which balanced scorecard perspective does this measure BEST fit?

AFinancial BCustomer CInternal business process DLearning and growth

Correct answer: D. Learning and growth
The learning and growth perspective tracks people, skills and capabilities that support future performance. Internal business process is close, but it measures how well operations run, not staff development.

Question 136Core Competencies⚑ Flag

A payment processor runs several analytics systems that only need a reference to each card number, not the real number. These systems are currently in PCI DSS scope, which drives up audit costs. The CFO asks the CISO how to lower that cost. What is the BEST recommendation?

AReplace card numbers in the analytics systems with tokens from a secured vault BEncrypt the card numbers and give each analytics system its own copy of the decryption key CMask the card numbers only on screens while keeping full values stored DMove the analytics systems to a cloud provider with PCI certification

Correct answer: A. Replace card numbers in the analytics systems with tokens from a secured vault
Tokens have no mathematical link to the card number, so systems that hold only tokens can often be removed from PCI DSS scope. Encrypted data with the key nearby stays in scope, masking only hides display, and a certified provider does not remove the customer's own scope.

Question 137Core Competencies⚑ Flag

What is the defining characteristic of the SABSA approach to enterprise security architecture?

AIt centers on product evaluation criteria used to pick security vendors BIt derives security architecture from business requirements and risks CIt is a certification scheme that rates individual security architects DIt begins with a fixed catalog of technical controls for every company

Correct answer: B. It derives security architecture from business requirements and risks
SABSA is business-driven, tracing every security decision back to business requirements and risk so the architecture supports what the organization needs. It is not a fixed control catalog, which is closer to how a control standard is used.

Question 138Core Competencies⚑ Flag

The board of an energy utility asks the CISO, "How well can we actually detect the attacks most likely to hit us?" The SOC tracks alert volumes but has no view of coverage. What is the BEST way to answer the board?

APresent the vendor's claimed detection rate for the SIEM and EDR products BCommission a penetration test and report the total number of findings to the board each quarter CReport the number of alerts the SOC handled each month over the past year DMap detections to ATT&CK techniques used by relevant threats and show gaps by risk

Correct answer: D. Map detections to ATT&CK techniques used by relevant threats and show gaps by risk
Mapping detection capability to the techniques used by threat actors that target the sector shows where coverage exists and where gaps remain, ranked by risk. Alert volume measures workload, not whether the organization can detect the attacks that matter.

Question 139Security Program & Operations⚑ Flag

After an outage, the CISO of Pemberton Telecom learns that 40 percent of last quarter's production changes were labeled emergencies. These changes skipped review and testing. Change managers say teams use the label to avoid delays. What should the CISO recommend?

AAdd more reviewers to the standard change advisory board meetings BBan all emergency changes for the next two quarters to reset habits CTighten emergency criteria and review each one afterward DLet each team lead approve their own emergency changes directly

Correct answer: C. Tighten emergency criteria and review each one afterward
Emergency changes are legitimate but must meet strict criteria and receive retrospective review so the label cannot be used to bypass controls. Banning them would leave the business unable to respond to real urgent needs, such as restoring service or fixing a critical flaw.

Question 140Core Competencies⚑ Flag

A pharmaceutical company is launching a data classification program. The CIO suggests that the IT team classify all data because it manages the storage systems. The CISO disagrees. Who should be responsible for assigning classification levels to business data?

AThe IT storage team, since it manages the systems where the data is stored BThe data owners in the business, with IT applying the controls as custodians CThe security team, since it best understands threats to each type of data DThe internal audit team, since it must remain independent of daily operations

Correct answer: B. The data owners in the business, with IT applying the controls as custodians
Data owners understand the business value and impact of their data, so they assign its classification, while IT acts as custodian and applies controls. IT may manage the systems, but it lacks the business context to judge sensitivity.

Question 141Governance, Risk & Audit⚑ Flag

A federal contractor follows the NIST Risk Management Framework for a new system. Controls have been implemented and assessed, and some weaknesses remain on the plan of action and milestones. Who should decide whether the system may operate with that remaining risk?

AThe information system security officer BThe system administrator CThe authorizing official DThe control assessor

Correct answer: C. The authorizing official
In the NIST RMF Authorize step, the authorizing official is the senior leader who accepts the residual risk and grants authorization to operate. The control assessor evaluates controls but does not make the risk acceptance decision.

Question 142Executive Leadership⚑ Flag

Sales leaders at Corrin Software say they lost three large deals this year because security questionnaires took weeks to answer and prospects doubted the company's controls. The CEO asks the CISO how security can help win business instead of slowing it. What is the BEST approach?

ABuild a customer trust program with ready evidence and expert help BExplain to sales that thorough security reviews cannot be sped up CPromise prospects that missing controls will be added after signing DLet sales staff answer questionnaires alone using past responses

Correct answer: A. Build a customer trust program with ready evidence and expert help
A trust program with ready answers, current assurance reports and fast access to security experts shortens sales cycles and shows customers that security is a strength. Letting sales reuse old answers alone risks inaccurate claims that can create contract and legal exposure.

Question 143Strategy, Finance & Vendors⚑ Flag

Eighteen months into a three-year security roadmap, the CEO of Pinecrest Foods announces the acquisition of a competitor with a very different technology environment. The roadmap was approved by the board last year. What should the CISO do?

AContinue the approved roadmap unchanged until the planned end date BReassess the roadmap against the new business strategy and acquisition CPause all roadmap work until the acquired company is fully integrated into operations DApply the existing roadmap to the acquired company without changes

Correct answer: B. Reassess the roadmap against the new business strategy and acquisition
A roadmap must stay aligned with business strategy, so a major acquisition is a trigger to revisit priorities, scope and funding. Keeping the roadmap unchanged because the board approved it ignores a major change in the business it is meant to support.

Question 144Core Competencies⚑ Flag

Which statement BEST describes the difference between data loss and data leakage?

AData loss means the organization can no longer use the data, while leakage is disclosure to outsiders BData loss applies only to paper records, while data leakage applies only to electronic records CData loss and data leakage are the same event described by different industry groups DData loss is always caused by insiders acting carelessly, while data leakage is always caused by outside attackers

Correct answer: A. Data loss means the organization can no longer use the data, while leakage is disclosure to outsiders
Data loss means data is destroyed, corrupted or otherwise unavailable to the organization, while data leakage is unauthorized disclosure of data to an outside party. Neither term depends on whether the cause is an insider or an outsider, or on the format of the records.

Question 145Core Competencies⚑ Flag

At a growing fintech, the enterprise architecture review board approves new systems without any security input. The CISO keeps discovering design weaknesses only after projects are built and live. Changing them now is expensive. What is the BEST long-term fix?

AAsk the CEO to personally approve every new system before it goes live BRequire each project manager to complete an online security course CMake security architecture a standing part of the review board's process DPerform a full security audit of every live system each quarter of the year

Correct answer: C. Make security architecture a standing part of the review board's process
Making security architects a standing voice on the review board puts security into design decisions when changes are cheap. Quarterly audits of live systems still find problems after build, which is the costly pattern the CISO wants to end.

Question 146Core Competencies⚑ Flag

During a major incident that has halted production at several plants, the IR team lead asks the CISO whether to shut down the remaining plants as a precaution. The decision would cost millions in lost output. Who should make this decision?

AThe CISO, who is accountable for the security program as a whole BThe crisis management team of senior executives, advised by security CThe plant managers, who each understand their own operations best DThe IR team lead, who has the most current technical information

Correct answer: B. The crisis management team of senior executives, advised by security
Decisions with major business impact belong to the crisis management team, which can weigh operational, financial, and safety factors with input from security. The IR team and CISO provide the technical risk view, but they should not make enterprise business trade-offs on their own.

Question 147Security Program & Operations⚑ Flag

The CISO of Ardent Media inherits 47 security tools, many with overlapping features and several with no assigned owner. License renewals cost $2 million a year, and analysts say they cannot keep up with so many consoles. The CFO asks for savings. What should the CISO do FIRST?

AReplace all tools with a single vendor's integrated platform BNegotiate a 20 percent discount on every renewal contract CCancel the tools that have no assigned owner right away DMap each tool to the controls and risks it supports

Correct answer: D. Map each tool to the controls and risks it supports
Mapping each tool to the controls and risks it supports reveals real overlaps and gaps, so consolidation does not remove needed coverage. Canceling ownerless tools right away is tempting but could disable a control that still protects a critical asset.

Question 148Core Competencies⚑ Flag

A law firm has a four-level classification policy, but attorneys often send confidential client files through personal email and consumer file-sharing sites. Interviews show staff do not know what each level requires. What should the CISO do to address this?

APublish simple handling standards per level and build them into everyday tools BAdd two more classification levels so that sensitive matters are more precisely defined CSend a firm-wide memo reminding staff that the policy already exists and applies DBlock all external email and file sharing for the firm until compliance improves

Correct answer: A. Publish simple handling standards per level and build them into everyday tools
Clear handling rules for each level, covering storage, sharing and disposal, plus labels and controls built into tools, make correct behavior easy. Blocking all external sharing would disrupt client service and push staff toward riskier workarounds.

Question 149Governance, Risk & Audit⚑ Flag

In COBIT 2019, which set of activities defines the governance objectives, as opposed to the management objectives?

APlan, build, run and monitor BEvaluate, direct and monitor CIdentify, protect and detect DAlign, plan and organize

Correct answer: B. Evaluate, direct and monitor
COBIT 2019 places governance objectives in the Evaluate, Direct and Monitor domain, which belongs to the governing body. Plan, build, run and monitor describes the management domains, and Align, Plan and Organize is one of them.

Question 150Executive Leadership⚑ Flag

Teller Global, a US public company, has just contained a cyber incident that disrupted order processing for two days. Securities rules require disclosure of incidents judged material within a short time after that judgment. The CEO asks the CISO to decide alone whether the incident is material. What should the CISO do?

ATreat the incident as immaterial unless customer data was confirmed stolen BDecide on materiality personally, since the CISO knows the facts best CWait until all forensic work is complete before any materiality review DGive facts and impact estimates to the disclosure committee and counsel

Correct answer: D. Give facts and impact estimates to the disclosure committee and counsel
Materiality is a business and legal judgment that weighs financial, operational and reputational impact, so it belongs with the disclosure committee and legal counsel, informed promptly by the CISO's facts. Waiting for forensics to finish can cause unreasonable delay, since the assessment should begin as soon as enough is known.