Free CCISO Practice Exam (2026)

Your score by topic

Get a free CCISO study plan on WhatsApp See CCISO Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Executive Leadership⚑ Flag

At Calder Bank, the CISO both runs security operations and certifies to regulators that those operations are effective. A regulator questions whether this arrangement is sound. What is the GREATEST concern?

AThe CISO is assessing their own work, weakening assurance BThe security team may need more staff to produce the reports on time CThe CISO may lack enough budget to run operations and assurance DRegulators generally prefer that the CIO sign security attestations

Correct answer: A. The CISO is assessing their own work, weakening assurance
When the same leader runs operations and also certifies their effectiveness, there is a self-review conflict that weakens independent assurance. Budget may also be a problem, but it does not explain why the regulator doubts the reliability of the certification.

Question 2Governance, Risk & Audit⚑ Flag

The CEO of a logistics firm tells the new CISO, "Cyber risk is your job now. Make whatever risk calls you need and just keep us out of the news." The CISO wants to set up sound governance from the start. What is the BEST response?

ADecline the new role until the board signs a formal liability waiver protecting the CISO personally BAccept full ownership of all cyber risk decisions, since the CEO has delegated that authority clearly CAgree to advise and report, while proposing that business leaders own and accept their risks DAsk for a much larger security budget in exchange for taking on full ownership of cyber risk

Correct answer: C. Agree to advise and report, while proposing that business leaders own and accept their risks
Cyber risk is a business risk, so business leaders should own and accept it while the CISO advises, measures and reports. Taking full ownership leaves business decisions with security and removes accountability from the people who create the risk.

Question 3Security Program & Operations⚑ Flag

A camera system records everyone who enters the data center so that investigators can review the footage later. How is this control BEST classified?

AAdministrative and corrective BPhysical and preventive CTechnical and preventive DPhysical and detective

Correct answer: D. Physical and detective
The camera is a physical control, and recording footage for later review identifies events after they occur, which makes it detective. It does not stop anyone from entering, so it is not preventive. A locked door or badge reader would be the physical preventive control.

Question 4Core Competencies⚑ Flag

A regional bank has budget to deploy multifactor authentication this year but cannot cover every system at once. Phishing attempts against staff are rising. The CISO must decide where to start. Which deployment priority is BEST?

AStart with the newest applications since they are easiest to integrate BStart with the executive team so that leaders set an example for staff CStart with the systems used by the most employees so adoption grows quickly DStart with privileged accounts, remote access and internet-facing applications

Correct answer: D. Start with privileged accounts, remote access and internet-facing applications
Privileged accounts, remote access and internet-facing apps are the most attractive targets for stolen credentials, so protecting them first reduces the most risk. Starting with the most-used systems builds adoption but may leave the highest-risk access exposed.

Question 5Core Competencies⚑ Flag

A bank wants to apply micro-segmentation to the data center hosting its core banking and payment applications. The COO has warned that any outage to payments will be escalated to the board. Application teams do not have full maps of how their systems talk to each other. What is the BEST approach for the CISO?

AEnforce default-deny rules on every workload in a single weekend change BMap traffic in monitor mode, then enforce on crown-jewel apps in phases CAsk each application team to write its own firewall rules with no review DDelay the project until every application has been fully redesigned

Correct answer: B. Map traffic in monitor mode, then enforce on crown-jewel apps in phases
Observing real traffic first and then enforcing in phases on the most critical applications reduces risk while avoiding payment outages. A big-bang default-deny change is likely to break undocumented flows, and leaving rules to each team without review creates inconsistent protection.

Question 6Core Competencies⚑ Flag

A software company is adopting DevSecOps. Developers complain that new security scans in the pipeline block releases for minor issues and slow down delivery. Some teams have started disabling the scans. What is the BEST way for the CISO to respond?

ARemove the scans from the pipeline and return to annual code audits BTune build-breaking thresholds to risk and support teams with champions CMake every scan finding, however minor, a hard stop for every single release DReport the teams that disabled scans to HR for disciplinary action

Correct answer: B. Tune build-breaking thresholds to risk and support teams with champions
Risk-based thresholds stop only serious issues while security champions help developers fix problems quickly, which keeps both speed and security. Removing the scans gives up early detection, and discipline alone does not fix a process developers see as unreasonable.

Question 7Core Competencies⚑ Flag

The board chair of a publicly traded software company learned about a significant data breach from a news report, three days after the security team had confirmed it. The chair is angry and asks the CISO to prevent this from happening again. What is the BEST corrective action?

AHave the CEO decide case by case when the board needs to be told about an incident BSend the board a weekly digest of every incident the SOC handles CCopy the board chair on all incident tickets rated high or above DAgree board notification criteria and timing, and write them into the IR plan

Correct answer: D. Agree board notification criteria and timing, and write them into the IR plan
Pre-agreed criteria for board notification remove guesswork during a crisis and make sure directors hear about material incidents promptly. Sending every incident or ticket floods the board with operational detail and buries the events that actually matter.

Question 8Strategy, Finance & Vendors⚑ Flag

The CISO of Tamsin Aerospace is starting the annual refresh of the security strategy. She wants to understand emerging regulations, new technology trends, shifts in the threat landscape and changes in customer expectations before setting priorities. Which activity BEST meets this need?

AAn internal audit of control compliance BA business impact analysis of key processes CAn environmental scan of external factors DA vulnerability scan of external systems

Correct answer: C. An environmental scan of external factors
Environmental scanning looks at external trends such as regulation, technology, threats and market changes that should shape strategy. A business impact analysis is useful for continuity planning, but it focuses on internal processes and recovery needs.

Question 9Executive Leadership⚑ Flag

During a board meeting at Fairmont Hotels, a director asks the CISO, "Are we secure?" What is the BEST way for the CISO to answer?

ASay no, because no organization can ever be completely secure BDescribe current risk compared to agreed appetite and key gaps CList the security tools deployed across the hotel properties DSay yes, because all required controls are now in place

Correct answer: B. Describe current risk compared to agreed appetite and key gaps
Security is never absolute, so the most useful answer describes risk against the board's appetite and names the gaps that need attention. A flat no is accurate but gives directors nothing they can act on.

Question 10Governance, Risk & Audit⚑ Flag

A CISO has drafted a new enterprise information security policy after consulting legal, HR and business units. The policy requires all employees to complete annual security training. Who should formally approve the policy so that it carries authority across the company?

AEach employee's direct supervisor BThe CISO who drafted the policy CSenior management or the board DThe IT service desk manager

Correct answer: C. Senior management or the board
Enterprise policies need approval from senior management or the board to show executive support and make them binding across the organization. The CISO drafts and maintains the policy, but self-approval would lack enterprise authority.

Question 11Security Program & Operations⚑ Flag

An internal audit at Marlowe Bank finds that the privileged access approval control is well designed and documented. However, samples show that one in four approvals happened after access was already granted. The CISO must report the finding to the risk committee. How should the CISO describe the control?

AWell designed but not operating effectively BPoorly designed and in need of full replacement CEffective, because most approvals were on time DEffective, because the design meets all requirements

Correct answer: A. Well designed but not operating effectively
A control can be well designed yet fail in operation, and the late approvals show this one is not working as intended. Calling it effective because the design is sound would mislead the committee, since risk reduction depends on consistent operation.

Question 12Core Competencies⚑ Flag

A media company's CEO wants to move all staff to passwordless sign-in using phishing-resistant passkeys. The CISO supports the goal and is planning the rollout. What is the GREATEST concern to address in the plan?

AUsers may need some time to get used to signing in without typing a password BAccount recovery and fallback methods could become the weakest point of entry COlder laptops may need a firmware update before they can support the new method DThe help desk may receive more calls during the first weeks of the rollout

Correct answer: B. Account recovery and fallback methods could become the weakest point of entry
If a lost device can be replaced through a weak recovery process, attackers will target that process and bypass the strong authenticator. User adjustment and help desk volume are real but manageable rollout issues, not security weaknesses.

Question 13Core Competencies⚑ Flag

An energy utility gives 40 outside vendors always-on VPN accounts so they can support equipment at any time. Several accounts belong to vendor staff who have left their companies. The procurement team says vendors need fast access to meet service levels. What is the BEST approach for the CISO?

AMove vendors to just-in-time, least-privilege access with session recording BLet each vendor manage its own staff list and accounts on the VPN CEnforce default-deny rules on every workload in a single weekend change window DRemove all vendor access and require vendors to work only on site

Correct answer: A. Move vendors to just-in-time, least-privilege access with session recording
Just-in-time, least-privilege access through zero trust or privileged access tools, with monitored sessions and matching contract terms, meets vendor needs while cutting standing risk. Annual password changes leave orphaned access open, and banning remote access would hurt service levels.

Question 14Core Competencies⚑ Flag

The executive committee asks the CISO for one metric showing whether the application security program is actually reducing risk. Which metric is MOST meaningful for this audience?

ACount of security tools licensed by the application security team BTotal number of static scans run across all repositories this quarter CTrend of critical vulnerabilities reaching production over time DNumber of developers who opened the secure coding training portal

Correct answer: C. Trend of critical vulnerabilities reaching production over time
The trend of critical flaws that escape into production measures an outcome tied to business risk. Scan counts, logins and tool counts measure activity, which can rise while real risk stays the same.

Question 15Core Competencies⚑ Flag

A multinational retailer is building its first computer security incident response team. The CISO has funding for a small core team. Which structure would BEST support effective incident handling across the organization?

AA fully outsourced team managed by the company's MSSP under a multi-year contract BA separate team in each country, each running its own processes CA technical team inside IT operations that escalates to the CIO DA core security team with named members from legal, HR, and communications

Correct answer: D. A core security team with named members from legal, HR, and communications
Incidents raise legal, HR, communications, and business issues as well as technical ones, so a core team supported by named cross-functional members handles them best. A purely technical team in IT cannot make or coordinate the non-technical decisions that major incidents require.

Question 16Strategy, Finance & Vendors⚑ Flag

The CISO of Granite Financial will present next year's security budget to the board. Last year the board cut the request, saying it was full of technical terms and product names. What is the BEST way to present the budget this time?

ACompare spending to industry averages and ask to match the average BPresent the full threat landscape to show how serious attacks are CShow detailed product specifications and architecture so the board sees the need DTie each request to business risks it reduces and objectives it supports

Correct answer: D. Tie each request to business risks it reduces and objectives it supports
Boards fund what they can connect to business outcomes, so each request should show what risk it reduces and which business goals it protects. Industry benchmarks can add context, but matching an average does not explain why the money matters for this company.

Question 17Executive Leadership⚑ Flag

The CISO of Stellan Group is building a reporting pack for executives. Which statement BEST describes the difference between a key risk indicator (KRI) and a key performance indicator (KPI)?

AA KRI gives early warning of rising risk, while a KPI tracks results BA KRI is only used by auditors, while a KPI is only used by the board CA KRI is always financial, while a KPI is always technical in nature DA KRI measures team activity, while a KPI measures exposure

Correct answer: A. A KRI gives early warning of rising risk, while a KPI tracks results
KRIs are forward-looking signals that risk is moving toward or beyond tolerance, while KPIs measure how well a process or program is achieving its goals. The first option reverses the two concepts.

Question 18Governance, Risk & Audit⚑ Flag

A CISO is reviewing a draft top-level security policy. It names specific firewall products and software versions that the company uses today. What is the BEST advice to the policy author?

AKeep the details, since specific policies are easier for staff to follow BMove the product details into standards so the policy stays stable CAdd every product the company uses so that the policy is complete DRemove the policy and rely on vendor product documentation instead

Correct answer: B. Move the product details into standards so the policy stays stable
High-level policies state intent and direction and should stay stable, while standards hold specific technical requirements that change with technology. Putting product details in the policy forces frequent executive re-approval whenever tools change.

Question 19Security Program & Operations⚑ Flag

A business unit asks the CISO of Linden Foods to deploy a $250,000 data protection platform for a marketing archive. A risk assessment puts the annualized loss expectancy for that archive at $15,000. The business unit head insists on the strongest possible protection. What should the CISO recommend?

AAccept the risk and apply no controls to the archive BEscalate the request to the board for a funding vote CDeploy the platform to satisfy the business unit head DSelect controls whose cost fits the level of risk

Correct answer: D. Select controls whose cost fits the level of risk
Controls should be proportionate to the risk they reduce, and spending $250,000 against a $15,000 annual loss exposure is hard to justify. Accepting the risk with no controls is also weak if inexpensive measures could bring the exposure further within appetite.

Question 20Core Competencies⚑ Flag

A consulting firm has moved most of its applications to SaaS, and consultants work from client sites and home. The board asks the CISO where the firm's main security boundary now lies. Which answer BEST reflects current strategy?

AThe virtual private network, which all consultants should use for every connection BThe office network firewall, which should be upgraded to inspect more traffic CUser and device identity, enforced through strong authentication and access policy DThe SaaS providers' data centers, which are fully responsible for securing access

Correct answer: C. User and device identity, enforced through strong authentication and access policy
When users and applications sit outside the corporate network, identity becomes the main control point for granting access. Upgrading the office firewall protects a network that most work no longer passes through.

Question 21Core Competencies⚑ Flag

Which statement BEST describes how Security Service Edge (SSE) differs from Secure Access Service Edge (SASE)?

ASSE provides the cloud security services of SASE without the SD-WAN component BSSE is designed for small businesses, while SASE is only for large enterprises CSSE replaces identity checks with network location, while SASE uses identity DSSE is an on-premises firewall product, while SASE runs only in the cloud

Correct answer: A. SSE provides the cloud security services of SASE without the SD-WAN component
SSE is the security part of SASE, typically secure web gateway, CASB and zero trust network access, delivered from the cloud without the SD-WAN networking piece. It is not an on-premises firewall or a product tier by company size, and both models rely on identity rather than location.

Question 22Executive Leadership⚑ Flag

Ostrava Holdings runs a central SOC and identity team that serves its eight subsidiaries. Subsidiary leaders complain that they do not know what services they receive or why they pay their share, and two have started buying duplicate tools. The group CEO asks the CISO to fix this. What is the BEST approach?

AStop charging subsidiaries and fund all services from group budget BLet each subsidiary buy its own security services from now on CDefine a service catalog with service levels and clear cost splits DRequire every subsidiary to use group services by executive order

Correct answer: C. Define a service catalog with service levels and clear cost splits
A shared services model works when subsidiaries can see what they receive, at what service level, and how costs are divided, which builds trust and reduces duplicate buying. Mandating use by order may stop duplication for a while, but it does not fix the lack of transparency behind the complaints.

Question 23Core Competencies⚑ Flag

Which testing approach examines source code for security flaws early in development without needing to run the application?

AStatic application security testing BExternal network penetration testing CRuntime application self-protection DDynamic application security testing

Correct answer: A. Static application security testing
Static testing analyzes source or compiled code without executing it, so it fits early in the lifecycle. Dynamic testing needs a running application and probes it from the outside, so it comes later.

Question 24Core Competencies⚑ Flag

A CISO at a regional bank is updating the ransomware playbook. Past incidents showed that staff did not know whether or when to contact law enforcement, and calls were made late or not at all. What should the CISO include to address this?

AA rule that law enforcement is contacted only after recovery is done BPre-set criteria for contact, approved by legal, plus advance relationships CAuthority for any SOC analyst to call law enforcement on their own DA policy that law enforcement is never contacted, to avoid publicity

Correct answer: B. Pre-set criteria for contact, approved by legal, plus advance relationships
Building relationships with law enforcement before an incident and setting criteria approved by legal allows fast, consistent engagement when it counts. Waiting until recovery is complete can lose useful intelligence and may conflict with legal or regulatory expectations.

Question 25Governance, Risk & Audit⚑ Flag

At Westford Group, five business units have each accepted a moderate risk tied to the same unpatched file transfer product. Each acceptance fell within that unit's own risk limits. No one has looked at the combined picture across the company. What is the CISO's GREATEST concern?

AThe combined exposure may exceed the enterprise risk appetite BEach business unit may have used a different risk scoring method CThe vendor may soon end support for the file transfer software DInternal audit may not have reviewed the acceptances this year

Correct answer: A. The combined exposure may exceed the enterprise risk appetite
Risks that look acceptable one at a time can add up to an enterprise exposure beyond appetite, especially when they share one weakness that a single attack could exploit everywhere. Inconsistent scoring is a real problem, but the bigger issue is that no one is viewing or owning the total risk.

Question 26Strategy, Finance & Vendors⚑ Flag

A CISO proposes automating identity lifecycle management. The project costs $300,000 up front and is expected to save $75,000 per year in help desk and audit costs. Ignoring the time value of money, what is the payback period?

A2.5 years B3 years C4 years D5 years

Correct answer: C. 4 years
The simple payback period is the investment divided by the annual savings, so $300,000 divided by $75,000 equals 4 years. The 5-year option would only be right if annual savings were $60,000.

Question 27Executive Leadership⚑ Flag

A product division at Orion Software keeps launching features without a security review, saying reviews slow releases. Leaders in the division are not hostile, just under deadline pressure. What should the CISO do FIRST?

ALet the division self-assess security risks with no oversight BEmbed a security partner and build reviews into its process CAsk the CEO to stop all of the division's releases until reviews happen DReport the division to internal audit as a policy violation

Correct answer: B. Embed a security partner and build reviews into its process
Embedding a security partner and fitting reviews into the existing release process removes the friction behind the bypass and builds trust. Halting all releases is heavy-handed and damages a relationship with leaders who are not acting in bad faith.

Question 28Security Program & Operations⚑ Flag

The CISO of Vesper Airlines wants assurance that newly implemented logging controls work as intended. The engineering team that built the controls offers to test them and sign off. The audit committee expects objective results. What is the BEST approach?

ASkip testing because the controls passed design review BWait for the external auditor's next annual review cycle CAccept the engineering team's test results and sign-off DHave a party independent of the builders test them

Correct answer: D. Have a party independent of the builders test them
Testing by a party independent of those who built or operate a control gives objective assurance and avoids self-review bias. Waiting for the external auditor delays assurance by up to a year and leaves possible gaps undetected in the meantime.

Question 29Core Competencies⚑ Flag

A manufacturer plans to federate identities with a key supplier so the supplier's engineers can use their own credentials to reach a shared design portal. The technical teams are ready to connect the systems. What should the CISO ensure is in place FIRST?

AA written trust agreement covering assurance levels, offboarding notice and liability BA security scan of the supplier's internet-facing systems carried out by the CISO's team CA shared account that the supplier's engineers can use while the federation is tested DA plan to issue the supplier's engineers internal accounts in case federation fails

Correct answer: A. A written trust agreement covering assurance levels, offboarding notice and liability
Federation means trusting the partner's identity process, so a written agreement must set authentication strength, timely notice when people leave, and who is liable. A scan of the supplier's systems does not establish how identities will be managed.

Question 30Governance, Risk & Audit⚑ Flag

A board has stated a low appetite for customer-facing service outages. The CISO wants operational teams to know when a situation needs to be escalated. What is the BEST way to put this appetite into practice?

AAsk the board to approve each outage-related decision as soon as it arises BDefine tolerance thresholds as key risk indicators with escalation triggers CSet a firm goal of zero outages and discipline any teams that fail to meet it DRewrite the board's risk appetite statement in more technical language for teams

Correct answer: B. Define tolerance thresholds as key risk indicators with escalation triggers
Risk tolerances turn a broad appetite into measurable limits, and key risk indicators with thresholds tell teams when to escalate. Sending every decision to the board is impractical and confuses governance with management.

Question 31Core Competencies⚑ Flag

An executive at a law firm lost a corporate-owned phone that held client merger documents. IT could not confirm whether the device had a passcode or encryption turned on. The managing partner asks the CISO how to prevent this risk in the future. What is the BEST control to put in place?

AGrant data access only to devices that meet MDM compliance checks BSend a reminder email asking staff to set strong passcodes on phones CAsk executives to report lost phones within one week of the loss DBuy insurance that covers the cost of replacing lost mobile devices

Correct answer: A. Grant data access only to devices that meet MDM compliance checks
Conditional access tied to MDM compliance ensures that only devices with encryption, passcodes and remote wipe can reach corporate data. Reminders and late reporting rely on user behavior, and device insurance covers hardware cost but not the exposure of client data.

Question 32Core Competencies⚑ Flag

A critical flaw is announced in a widely used logging library. The CEO asks which of the company's purchased software products contain it. The CISO cannot answer because vendors have never provided component lists, and responses take weeks to collect. What should the CISO do to prevent this situation in the future?

AReplace all purchased software with applications built entirely in-house BSend every vendor a questionnaire only after each new flaw is announced CRely on vendors to announce on their own whether their products are affected DRequire vendors to deliver and maintain SBOMs as part of procurement contracts

Correct answer: D. Require vendors to deliver and maintain SBOMs as part of procurement contracts
Contractually required, maintained software bills of materials let the company quickly find affected products when a component flaw appears. Sending questionnaires after each event repeats the slow, reactive process that failed this time.

Question 33Core Competencies⚑ Flag

During a service outage caused by a security incident at a payments company, several engineers posted their own theories about the cause on social media. Reporters began quoting them. What should the CISO push for to prevent a repeat?

AA communications plan with one spokesperson and pre-approved statements BBlock access to social media sites from the corporate network CAsk engineers to post corrections whenever they see wrong reports DDiscipline the engineers who posted, as a clear warning to the rest of the staff

Correct answer: A. A communications plan with one spokesperson and pre-approved statements
A crisis communications plan with a single spokesperson, ready-made holding statements, and clear staff guidance keeps external messages accurate and consistent. Discipline may follow under existing policy, but without a plan the same confusion will happen again in the next incident.

Question 34Strategy, Finance & Vendors⚑ Flag

A security investment costs $100,000 today and is expected to produce a single benefit of $121,000 at the end of year two. The company uses a 10% discount rate. What is the net present value of the investment?

A$10,000 B-$10,000 C$0 D$21,000

Correct answer: C. $0
The present value of $121,000 in two years at 10% is $121,000 divided by 1.21, which is $100,000. Subtracting the $100,000 cost gives an NPV of $0. The $21,000 option ignores the time value of money.

Question 35Executive Leadership⚑ Flag

The CISO of Marlow Healthcare has a small team that cannot reach every department. The CISO wants security considered in daily decisions across the organization. Which initiative would BEST help?

ABuild a network of trained security champions in departments BRequire each department head to complete an online security course CSend a monthly security newsletter to all employees by email DHire an outside firm to run quarterly security audits in each department

Correct answer: A. Build a network of trained security champions in departments
Trained champions inside departments extend the security team's reach and bring security thinking into daily work. A newsletter raises awareness but does not put an informed voice in the room when local decisions are made.

Question 36Governance, Risk & Audit⚑ Flag

A CISO's risk register shows twelve high risks whose treatment plans are more than six months overdue. Most belong to business units that say they lack budget. What should the CISO do?

AUse the security budget to fix all twelve risks without the business units BLower the risk ratings so they no longer appear as high on the report CClose the overdue risks in the register to keep the report looking accurate DEscalate the overdue risks through the governance committee for decisions

Correct answer: D. Escalate the overdue risks through the governance committee for decisions
Overdue treatment of high risks needs a leadership decision to fund the work, change the plan or formally accept the risk. Funding everything from the security budget removes business accountability, and altering the register hides the real exposure.

Question 37Security Program & Operations⚑ Flag

At Brandt Logistics, the three security engineers who administer the SIEM also have rights to delete and change its stored logs, including records of their own actions. No one outside the team reviews their activity. The CISO trusts the team but wants a sound control design. What is the BEST approach?

AMove all SIEM administration rights from the team to the help desk BLog their admin actions to a tamper-proof store reviewed by others CHave each engineer sign a yearly statement that no logs were altered DRotate SIEM administration duties among the engineers every quarter

Correct answer: B. Log their admin actions to a tamper-proof store reviewed by others
Security staff hold powerful access, so their own actions should be recorded where they cannot change them and reviewed by someone outside the team. Rotating duties among the same engineers still leaves no independent check on logs they can alter.

Question 38Core Competencies⚑ Flag

A company plans to dismiss a database administrator for poor conduct next Friday afternoon. HR usually notifies IT of departures by email the following Monday. The CISO is concerned about the timing. What is the BEST action?

ALet the administrator's manager decide whether access should be removed and when BAsk IT to watch the administrator's activity closely during the week after the meeting CCoordinate with HR so all access is disabled at the moment the dismissal is delivered DChange the shared database passwords on Monday morning once the HR email arrives

Correct answer: C. Coordinate with HR so all access is disabled at the moment the dismissal is delivered
For involuntary terminations of privileged users, access should be revoked at the time of notification so there is no window for retaliation. Waiting for a Monday email leaves the person with powerful access after learning of the dismissal.

Question 39Core Competencies⚑ Flag

A hospital group reports that EDR is installed on 80 percent of its endpoints. The remaining devices include legacy imaging workstations and laptops used by contractors. The board asks the CISO whether the hospital is protected. What should the CISO do FIRST?

AReport to the board that 80 percent coverage already meets common industry norms BBuild a complete endpoint inventory to find and assess the coverage gaps CBuy a second EDR product for the devices that lack an agent today DDisconnect all legacy imaging workstations from the network at once

Correct answer: B. Build a complete endpoint inventory to find and assess the coverage gaps
The CISO cannot judge exposure without knowing exactly which devices lack coverage and how critical they are, so a full inventory comes first. Reporting coverage as adequate may mislead the board, and buying tools or disconnecting clinical devices is premature and could affect patient care.

Question 40Core Competencies⚑ Flag

An expense audit at a media company shows that business units are paying for more than 30 different AI services on corporate cards. None went through security or privacy review. The CEO supports AI use but wants the risk under control. What should the CISO do FIRST?

ACancel all of the AI subscriptions immediately and block the services BApprove every tool now in use so business units are not disrupted at all CAssign the procurement team to negotiate better pricing for each service DInventory AI tools and data uses, then risk-rank them through governance

Correct answer: D. Inventory AI tools and data uses, then risk-rank them through governance
An inventory of shadow AI tools and the data they touch, reviewed through a governance process, shows where the real risk lies and brings use under control. Cancelling everything ignores the CEO's support for AI and disrupts teams without knowing which tools are actually risky.

Question 41Core Competencies⚑ Flag

A European subsidiary of a marketing firm confirms that personal data was exposed. The general counsel suggests waiting until the forensic investigation finishes in about three weeks before deciding on any notifications. What is the CISO's GREATEST concern?

AThe final investigation report may be less detailed than expected BNotification deadlines may run from awareness, not from the investigation's end CThe forensic firm may raise its fees if the timeline is extended DCustomers may move to competitors once the breach becomes public

Correct answer: B. Notification deadlines may run from awareness, not from the investigation's end
Many breach laws, including GDPR's 72-hour rule for notifying supervisory authorities, start the clock when the organization becomes aware of a breach. Notifications can be made with the facts available and updated later. Waiting for the full investigation risks missing legal deadlines.

Question 42Executive Leadership⚑ Flag

At Vantage Shipping, employees who click on phishing tests are named in team meetings and face written warnings. Since this policy began, reports of real suspicious emails have dropped sharply. What is the MOST likely cause, and the best fix?

AEmployees need longer training sessions on recognizing phishing emails BPhishing attacks have dropped, so the program should stay as it is CStaff fear blame and hide mistakes, so shift to a just culture DThe email filter got better, so phishing tests should be stopped

Correct answer: C. Staff fear blame and hide mistakes, so shift to a just culture
Punishment makes people afraid to admit mistakes, so they stop reporting, which hides real attacks. A just culture that rewards reporting and coaches rather than shames restores the early warning. Assuming attacks have dropped ignores the clear timing link to the new policy.

Question 43Governance, Risk & Audit⚑ Flag

The CISO of Harwell Group is building a metrics model based on goals, performance and risk. The CEO wants one type of indicator that shows, after the fact, whether a business goal supported by security was actually achieved. Which type of indicator BEST fits this need?

AKey goal indicator (KGI) BKey performance indicator (KPI) CKey risk indicator (KRI) DKey control indicator (KCI)

Correct answer: A. Key goal indicator (KGI)
In goal-based metrics models, a KGI is a lagging measure that tells management after the fact whether a goal was met. A KPI measures how well a process is performing and helps predict whether the goal will be reached, while a KRI warns of rising risk.

Question 44Strategy, Finance & Vendors⚑ Flag

A data center asset is valued at $500,000, and a flood would destroy 40% of its value. Floods are expected once every two years. A proposed control would reduce that to once every ten years. What is the most the company should spend per year on this control for it to be cost-justified?

A$100,000 B$200,000 C$20,000 D$80,000

Correct answer: D. $80,000
The single loss expectancy is $500,000 times 40%, or $200,000. ALE drops from $200,000 times 0.5, which is $100,000, to $200,000 times 0.1, which is $20,000, so the control is justified up to $80,000 per year. The $100,000 option is the current ALE, not the reduction in loss.

Question 45Security Program & Operations⚑ Flag

The CISO of Granite Utilities manages a portfolio of nine security projects. A review shows that an identity governance project is 60 percent over budget, and the risk it addresses has since been reduced by a new cloud platform. Its sponsor wants to continue. What should the CISO do?

ARecommend ending it and redirecting the funds BExtend the timeline so the overrun spreads across years CShift the project's remaining work to the help desk team DContinue the project because funds were already spent

Correct answer: A. Recommend ending it and redirecting the funds
Portfolio management means regularly checking whether each project still delivers enough value for its cost. When the underlying risk has shrunk and costs have grown, redirecting funds to higher-risk work is the sound choice. Continuing because money was already spent is the sunk cost fallacy.

Question 46Core Competencies⚑ Flag

At a growing fintech, new hires receive access by copying the profile of a coworker in the same team. An audit finds new employees with rights to systems unrelated to their jobs. What is the BEST long-term fix?

AAsk each new hire to report any access they believe they should not have received BRequire the security team to approve every single access request for new hires CDefine standard access by job role and grant extra rights only through approved requests DStop copying profiles from tenured staff and copy them from newer employees instead

Correct answer: C. Define standard access by job role and grant extra rights only through approved requests
Role-based birthright access gives each new hire a defined starting set tied to the job, with extra rights handled through approval. Copying profiles passes along whatever excess rights the coworker has built up over time.

Question 47Executive Leadership⚑ Flag

Brennan Construction lost money last year when finance staff wired funds based on fake supplier emails. The CISO's awareness program uses the same general course for all staff. What is the BEST improvement?

ADouble the length of the general course for every employee BAdd a policy acknowledgment form to the employee handbook CSend a company-wide warning email about wire fraud each quarter DAdd role-based training and payment checks for finance staff

Correct answer: D. Add role-based training and payment checks for finance staff
Finance staff face targeted payment fraud, so role-specific training paired with process controls such as callback verification addresses the actual risk. A longer general course adds time for everyone without focusing on the people and processes that were exploited.

Question 48Core Competencies⚑ Flag

The security team at Kestrel Chemicals wants to add automatic account lockout after three failed logins on the operator consoles in the plant control room. Operators use these consoles to respond to alarms, including emergency shutdowns. The plant safety manager objects. What should the CISO do?

AExempt the control room from all security controls to protect safety BApply the lockout only on night shifts, when fewer alarms usually occur CApply the lockout because the corporate standard requires it everywhere DChoose controls that cannot block emergency action, with safety staff

Correct answer: D. Choose controls that cannot block emergency action, with safety staff
In OT environments safety comes first, so controls must never stop an operator from responding to an emergency. The CISO should work with safety engineers on alternatives such as strong physical access control and monitoring. Exempting the control room from all controls overcorrects and leaves real security risks unmanaged.

Question 49Core Competencies⚑ Flag

A healthcare provider is negotiating with a vendor whose AI service will summarize patient records. The vendor's standard terms allow it to use customer data to improve its models. The CISO is reviewing the contract before signing. What is the GREATEST concern to resolve?

AWhether the vendor's interface supports the company's preferred colors BWhether patient data could be used to train models shared with others CWhether the vendor can deliver the service in several spoken languages DWhether the service runs on the newest generation of server hardware

Correct answer: B. Whether patient data could be used to train models shared with others
If patient data is used to train shared models, it may be exposed to others and break privacy obligations, so the contract must restrict it. Interface options, languages and hardware are operational details that do not create the same legal and confidentiality risk.

Question 50Core Competencies⚑ Flag

After a contained ransomware incident at a food distributor, the CISO is preparing a report for the board. What should the report focus on?

AThe names of the staff involved and the mistakes each of them made BA comparison of the EDR tools that could have stopped the attack CBusiness impact, root cause, remediation status, and residual risk DA full timeline of attacker actions with all indicators of compromise

Correct answer: C. Business impact, root cause, remediation status, and residual risk
Directors need to understand what the incident cost the business, why it happened, what is being fixed, and what risk remains so they can perform oversight. Detailed attacker timelines and indicators are useful for the technical team, but they do not support board-level decisions.

Question 51Governance, Risk & Audit⚑ Flag

A media company plans to add a feature that stores users' government ID scans for age checks. The assessment shows high legal and breach risk, and the feature would add little revenue. Leadership decides not to build it. Which risk treatment has leadership chosen?

ARisk mitigation BRisk acceptance CRisk transfer DRisk avoidance

Correct answer: D. Risk avoidance
Choosing not to perform the activity that creates the risk is risk avoidance. Mitigation would build the feature with added controls, and transfer would shift part of the impact to a third party such as an insurer.

Question 52Strategy, Finance & Vendors⚑ Flag

The CFO of Harlow Group wants to charge business units for all security services based on usage. The CISO supports more cost transparency but sees a risk in the plan. What is the GREATEST concern with charging back every security service?

AThe security team will have to track usage data for each service BBusiness units may ask the security team for more detailed reports CBusiness units may drop essential baseline controls to save money DFinance staff may need extra time to calculate monthly charges

Correct answer: C. Business units may drop essential baseline controls to save money
If every control is charged back, business units may decline baseline protections to cut their costs, which creates risk for the whole company. A common fix is to fund baseline controls centrally and charge back only optional or usage-based services.

Question 53Executive Leadership⚑ Flag

The CISO of Delmar Insurance has 14 direct reports covering operations, architecture, governance, and awareness. Decisions are slowing and staff say they cannot get time with the CISO. What is the BEST structural change?

AGive every direct report final authority on all risk decisions BAdd a management layer grouping teams under a few senior leaders CHold one long weekly meeting with all 14 direct reports at once DCut team sizes so that fewer people report to the CISO overall

Correct answer: B. Add a management layer grouping teams under a few senior leaders
Grouping related teams under a few senior leaders reduces the CISO's span of control so the CISO can focus on strategy while decisions keep moving. Cutting team sizes reduces capability rather than fixing the structure.

Question 54Security Program & Operations⚑ Flag

After a maturity assessment, the CISO of Alder Credit Union finds most security processes at Level 2. A consultant recommends raising every process to Level 5 within two years. The board has a moderate risk appetite and a tight budget. What is the BEST approach?

APostpone maturity work until the budget situation improves BPursue Level 5 for every process as the consultant advised CSet a target level for each process based on its risk DRaise every process to Level 3 before any other investment

Correct answer: C. Set a target level for each process based on its risk
Target maturity should reflect the risk each process addresses and its value to the business, not the highest possible level. Level 5 everywhere is costly and rarely justified for a moderate risk appetite. A uniform Level 3 target ignores that some processes matter far more than others.

Question 55Core Competencies⚑ Flag

A cloud-native retailer finds that service accounts, API keys and workload identities now outnumber human users by ten to one. Many have no known owner and never expire. The CISO is updating the IAM strategy. What is the MOST important step?

AAssign an accountable owner to each non-human identity and include them in governance BAsk developers to stop creating service accounts until a new tool is purchased CRotate all API keys once a year during the scheduled maintenance window DDelete every non-human identity that has not been used in the past 30 days

Correct answer: A. Assign an accountable owner to each non-human identity and include them in governance
Non-human identities need clear owners, lifecycle rules and reviews just like human accounts, so bringing them under governance is the key strategic step. Deleting unused ones without owners could break critical services nobody knew depended on them.

Question 56Governance, Risk & Audit⚑ Flag

A CISO is explaining risk terms to a new audit committee member. In risk management, what does inherent risk represent?

AThe risk that remains after all planned controls are in place BThe level of risk before any controls or treatments are applied CThe risk that the organization's auditors fail to detect an error DThe amount of risk the board is willing to take to reach its goals

Correct answer: B. The level of risk before any controls or treatments are applied
Inherent risk is the exposure that exists before controls or other treatments are applied. The risk remaining after controls is residual risk, and the amount leadership is willing to take is risk appetite.

Question 57Core Competencies⚑ Flag

A faulty content update from a widely used endpoint security vendor crashed thousands of a retailer's point-of-sale systems at once. Stores could not take payments for most of a day. The CEO asks the CISO what should change in the endpoint security strategy. What is the MOST important change?

ARequire staged rollout of agent updates and resilience terms in vendor contracts BSwitch to a different endpoint vendor as soon as the current contract allows CAsk store managers to restart point-of-sale systems more often during the day DRemove endpoint protection from point-of-sale systems entirely to avoid future crashes

Correct answer: A. Require staged rollout of agent updates and resilience terms in vendor contracts
Staged rollouts and contract terms covering update testing and recovery reduce the chance that one bad update stops the whole business. Removing protection raises security risk, and switching vendors alone does not fix the lack of staged deployment control.

Question 58Core Competencies⚑ Flag

A chemical plant relies on older networked sensors and controllers that the manufacturer no longer patches. Replacing them would cost millions and halt production for months. The plant manager asks the CISO how to manage the risk until replacement is funded. What is the BEST approach?

AShut down the plant until every device can be patched or replaced BIgnore the devices since they have not been attacked in the past CApply compensating controls like segmentation and record the risk DConnect the devices to the internet so the vendor can manage them

Correct answer: C. Apply compensating controls like segmentation and record the risk
Isolating the devices, monitoring them and formally recording the residual risk protects operations while replacement is planned and funded. Shutting the plant is not business-aligned, and assuming safety because nothing has happened yet is not risk management.

Question 59Core Competencies⚑ Flag

The CIO of an insurance company proposes active-active data centers for all 300 applications to eliminate downtime. The plan would triple infrastructure costs. The BIA shows that only 25 applications support time-critical processes. What should the CISO recommend?

AReject the plan and keep the current single data center setup BApprove the plan, since zero downtime removes recovery risk CRely on cloud backups for all applications to lower the cost DTier the applications by BIA criticality and match strategies

Correct answer: D. Tier the applications by BIA criticality and match strategies
Recovery strategies should match the business impact of each application, so the costly options are reserved for the time-critical systems. Active-active for everything spends heavily on applications that can tolerate days of downtime, which is not a sound risk-based use of budget.

Question 60Executive Leadership⚑ Flag

Truro Partners plans to outsource much of its security program to cut costs. Which function should the CISO MOST strongly insist on keeping in-house?

APenetration testing of new applications before launch BVulnerability scanning of internet-facing systems CRound-the-clock log monitoring and alert triage DSecurity governance and risk acceptance decisions

Correct answer: D. Security governance and risk acceptance decisions
Governance and risk acceptance decisions require knowledge of business goals and legal accountability that cannot be handed to a vendor. Monitoring, scanning, and testing are operational services that providers commonly deliver well under the organization's oversight.

Question 61Strategy, Finance & Vendors⚑ Flag

Sterling Logistics has fully defined its requirements for 2,000 hardware security keys, including model, standards and delivery dates. Four approved suppliers can meet the specification. The procurement team asks which document to send. What is the BEST choice?

AA request for quotation BA memorandum of understanding CA request for information DA request for proposal

Correct answer: A. A request for quotation
A request for quotation is used when requirements are fully defined and the main difference between suppliers is price and terms. A request for proposal fits when vendors must propose how they would meet more open requirements.

Question 62Governance, Risk & Audit⚑ Flag

A university completed its annual enterprise risk assessment in January. In April, it moves its student records system to a public cloud provider. The next assessment is not scheduled until the following January. What should the CISO do?

AWait for the next annual assessment, since that schedule was already approved BReassess the student records system now, because of the major change CAsk the cloud provider to take over the risk assessment for the university DRecord the migration in the register as a closed, low-priority change item

Correct answer: B. Reassess the student records system now, because of the major change
Significant changes, such as moving sensitive data to a cloud provider, should trigger a risk reassessment rather than waiting for the annual cycle. The university remains accountable for its data, so it cannot hand the assessment to the provider.

Question 63Security Program & Operations⚑ Flag

The SOC at Fairhaven Bank built one dashboard with 45 metrics, and it goes to analysts, IT managers and the executive committee alike. Executives say they cannot find what matters, while analysts say it updates too slowly for daily work. What should the CISO do?

AAdd more metrics so that every audience can find what it needs BSend raw data to each group so that it can build its own reports CCut the dashboard down to the five metrics that executives like most DBuild tiered views with metrics suited to each audience's decisions

Correct answer: D. Build tiered views with metrics suited to each audience's decisions
Different audiences make different decisions, so operational teams need detailed, frequent metrics while executives need a short summary drawn from the same data. Cutting to five executive metrics would leave analysts and managers without the detail they need for daily work.

Question 64Core Competencies⚑ Flag

A research lab hosts many visitors each week. A walkthrough finds visitor badges that look like employee badges, many unreturned badges, and visitors walking alone through lab areas. What should the CISO implement?

AA rule that visitors may only enter the building during normal business hours BAdditional cameras in the lobby so that visitor arrivals are always recorded CA visitor process with ID checks, distinct dated badges, escorts and sign-out DA requirement that visitors sign a confidentiality agreement at the front desk

Correct answer: C. A visitor process with ID checks, distinct dated badges, escorts and sign-out
A sound visitor management process verifies identity, issues visibly distinct time-limited badges, requires escorts in sensitive areas and confirms sign-out. Lobby cameras record arrivals but do nothing to stop visitors from wandering into restricted spaces.

Question 65Executive Leadership⚑ Flag

The CISO of Glenmore Analytics has lost four strong engineers in six months. Exit interviews mention unclear career growth and little recognition, not pay. What should the CISO do FIRST?

AGive every engineer an immediate across-the-board salary increase BCreate clear career paths and hold regular stay interviews CRequire two-year commitments from all new security hires DHire contractors to replace departing staff more quickly

Correct answer: B. Create clear career paths and hold regular stay interviews
The exit data points to growth and recognition, so career paths and stay interviews address the real reasons people leave. A salary increase is tempting, but it does not fix the problems staff actually named.

Question 66Core Competencies⚑ Flag

A cloud access security broker pilot at a marketing agency discovers employees using more than 400 unapproved SaaS applications. Some of them store client creative files. The managing director worries that blocking everything will hurt productivity. What should the CISO do FIRST?

ASend a company-wide email warning that shadow IT is now banned BBlock every unapproved application at the web proxy starting tomorrow morning CRank the apps by risk and work with business units to approve, replace or block DIgnore the findings because the apps help employees do their work

Correct answer: C. Rank the apps by risk and work with business units to approve, replace or block
Risk-ranking the discovered apps and agreeing with business units on which to sanction, replace or block balances security with productivity. Blocking everything disrupts work and drives users to workarounds, while ignoring the findings leaves client data exposed.

Question 67Core Competencies⚑ Flag

A consortium of banks wants to place customer identity records on a shared, permanent blockchain ledger to speed up onboarding. The CISO of one member bank is asked to review the plan. The bank operates under privacy laws that grant a right to erasure. What is the GREATEST concern?

APersonal data on an immutable ledger may conflict with erasure duties BOther banks in the group may be larger than the CISO's own institution CBlockchain transactions may confirm a few seconds slower than a database DThe consortium's logo may not appear on all of the onboarding screens

Correct answer: A. Personal data on an immutable ledger may conflict with erasure duties
Data written to an immutable ledger is very hard to delete, which can conflict with legal duties to erase personal information on request. Slightly slower confirmations are a performance trade-off, not a compliance risk.

Question 68Core Competencies⚑ Flag

Which recovery metric MOST directly determines how frequently backups or data replication must occur?

ARecovery time objective (RTO) BRecovery point objective (RPO) CMaximum tolerable downtime (MTD) DMean time to repair (MTTR)

Correct answer: B. Recovery point objective (RPO)
RPO defines the maximum amount of data loss, measured in time, that the business can accept, so it drives backup and replication frequency. RTO is about how quickly service must be restored, not how much data can be lost.

Question 69Governance, Risk & Audit⚑ Flag

A SaaS company earned ISO/IEC 27001 certification for its headquarters data center only. Sales staff now tell prospects that the whole company, including its cloud product, is certified. What should the CISO do FIRST?

ACorrect the sales claims so they match the certified ISMS scope BAsk the certification body to reissue the certificate company-wide CLet the claims stand, since the product follows the same policies DExpand the certification to every site before the end of the next quarter

Correct answer: A. Correct the sales claims so they match the certified ISMS scope
Certification applies only to the defined ISMS scope, so claims beyond it mislead customers and create legal and reputational risk. Expanding scope may be a good later goal, but it takes time and does not fix the false claims being made now.

Question 70Strategy, Finance & Vendors⚑ Flag

A SaaS vendor that will hold millions of customer records at Bayview Telecom proposes to limit its total liability to the fees paid in the prior 12 months, about $200,000. Legal estimates a major breach could cost Bayview several million dollars. What should the CISO recommend?

AAccept the cap since it is standard language in most SaaS contracts BReject the vendor since no contract can make this risk acceptable CSeek a higher cap or carve-out for data breaches and check vendor insurance DAsk the vendor to share its source code as a substitute for liability

Correct answer: C. Seek a higher cap or carve-out for data breaches and check vendor insurance
The CISO should work with legal to negotiate liability and indemnification that better match the potential breach impact, and confirm the vendor carries enough cyber insurance. Accepting the cap because it is common leaves Bayview carrying almost all the financial risk of a vendor failure.

Question 71Security Program & Operations⚑ Flag

The CISO of Sable Hotels is launching a multi-factor authentication project for all staff. Front-desk managers resist, fearing longer check-in times during peak hours. The project is on schedule, but adoption is low in the pilot hotels. What should the CISO do FIRST?

AMandate MFA by policy and report noncompliant managers BMeet front-desk managers to address their workflow concerns CDelay the project until front-desk managers request it DExempt all front-desk staff from MFA requirements permanently

Correct answer: B. Meet front-desk managers to address their workflow concerns
Stakeholder engagement uncovers the operational concerns that drive resistance and opens options such as faster authenticators at the front desk. Mandating compliance first may increase resistance and workarounds without fixing the underlying issue.

Question 72Core Competencies⚑ Flag

A utility company runs physical security and cybersecurity as separate departments with separate tools. During an incident review, it took days to learn that an employee's badge was used at a substation while the same user's account logged in from overseas. What should the CISO propose?

AReplace the badge system with biometric readers at every substation entrance BAsk the physical security team to send the cybersecurity team monthly reports CKeep the departments separate but schedule a joint meeting once each quarter DConverge physical and logical security governance so events can be correlated

Correct answer: D. Converge physical and logical security governance so events can be correlated
Converging physical and logical security brings shared governance, data and response, so linked events like these can be spotted quickly. Quarterly meetings or monthly reports would still leave days or weeks of delay in seeing related activity.

Question 73Executive Leadership⚑ Flag

The CISO of Ridgeway Public Services wants a common way to define security roles, map skills gaps, and plan training for the workforce. Which resource is designed for this purpose?

AThe NICE Workforce Framework for Cybersecurity BISO/IEC 27002 control guidance CThe COBIT 2019 design factors DThe NIST Cybersecurity Framework (CSF) 2.0

Correct answer: A. The NICE Workforce Framework for Cybersecurity
The NICE Workforce Framework, published by NIST, defines work roles, tasks, knowledge, and skills, so it is built for workforce planning and training. The NIST CSF organizes security outcomes for the organization, not workforce roles and skills.

Question 74Core Competencies⚑ Flag

An organization moves a database from a self-managed virtual machine on IaaS to a managed database service on PaaS. Under the shared responsibility model, which task MOST likely shifts to the cloud provider?

AClassifying the data stored in the database BPatching the operating system under the database CChoosing which records must be kept for legal reasons DDeciding which users may query the database

Correct answer: B. Patching the operating system under the database
With a managed PaaS database, the provider takes over operating system and database engine patching that the customer handled on IaaS. Access decisions, data classification and retention duties stay with the customer in every service model.

Question 75Core Competencies⚑ Flag

A mid-size retailer's security team subscribes to six threat intelligence feeds. Analysts are flooded with alerts and indicators, yet leaders cannot point to any decision the intelligence has changed. What should the CISO do FIRST?

AHire more analysts to read every indicator the feeds produce BCancel all feeds and stop using threat intelligence entirely CSubscribe to several more feeds so that fewer threats are missed DDefine intelligence requirements based on business priorities

Correct answer: D. Define intelligence requirements based on business priorities
Intelligence requirements state what decision-makers need to know, which lets the team filter feeds and produce intelligence that drives action. Adding feeds or analysts increases volume without fixing the lack of focus.

Question 76Governance, Risk & Audit⚑ Flag

A company's ISMS has run for a year. The CISO has been reviewing metrics and audit results alone and making changes as needed. An ISO/IEC 27001 auditor raises a nonconformity. Which requirement has MOST likely been missed?

AAll security metrics must be published to every employee BThe ISMS must be reviewed by an outside consultant each year CThe CISO must hold a lead auditor credential for the standard DTop management must review the ISMS at planned intervals

Correct answer: D. Top management must review the ISMS at planned intervals
ISO/IEC 27001 requires top management to review the ISMS at planned intervals to confirm it remains suitable, adequate and effective. A review by the CISO alone does not meet that leadership requirement, and the standard does not require outside consultants.

Question 77Core Competencies⚑ Flag

A media company has just finished its first disaster recovery plan, and it has never been tested. A board member suggests a full interruption test next month to prove the plan works. What should the CISO recommend?

AStart with tabletop and walkthrough tests, then move to live tests BSkip testing until the plan has been updated for the next fiscal year CAsk the DR vendor to certify the plan as working instead of testing DCarry out the full interruption test as proposed, to show confidence

Correct answer: A. Start with tabletop and walkthrough tests, then move to live tests
Testing should progress from low-risk tabletop and walkthrough exercises to simulations and parallel tests before any full interruption. Running a full interruption test on an untested plan could cause the very outage the plan is meant to prevent.

Question 78Executive Leadership⚑ Flag

A newly hired CISO joins Sutton Medical Group, which has had two breaches in three years. The CEO expects a plan quickly. What should the CISO do FIRST?

AReorganize the security team in the first two weeks to show change BPresent a large budget request to the board in the first month CMeet key stakeholders and assess the current state and risks DReplace the existing security tools with platforms the CISO knows well

Correct answer: C. Meet key stakeholders and assess the current state and risks
A new CISO first needs to understand the business, build relationships, and assess current risks so the plan fits the organization. Replacing tools right away is premature and may discard working capabilities before the CISO knows what the real gaps are.

Question 79Security Program & Operations⚑ Flag

The COO of Corvid Payments asks the CISO to finish an encryption project four weeks earlier than planned to create a buffer before a regulatory deadline. The budget is fixed, and the project team is already fully allocated. What is the BEST response?

APresent the scope, cost and quality trade-offs BRefuse because the original schedule was already approved CAgree and skip the testing phase to save four weeks DAgree and ask the team to work longer hours to finish

Correct answer: A. Present the scope, cost and quality trade-offs
With budget and staff fixed, shortening the schedule requires reducing scope or accepting quality risk, and the sponsor should decide with those trade-offs in view. Skipping testing appears to save time but may leave the encryption faulty, which defeats the regulatory goal.

Question 80Core Competencies⚑ Flag

To cut costs, the COO of a jewelry distributor proposes removing night guards from the main vault building and relying on recorded cameras. The CISO is asked for an opinion. What is the CISO's GREATEST concern with this proposal?

ARecorded cameras may require more storage space and a larger annual budget BCameras detect events but do not delay intruders or provide a timely response CInsurance providers may ask for a short report describing the new arrangement DEmployees may feel less comfortable when working late in the vault building

Correct answer: B. Cameras detect events but do not delay intruders or provide a timely response
Layered physical security relies on deterring, detecting, delaying and responding, and recorded cameras mainly support detection and investigation. Without guards or another response capability, an intrusion may only be discovered after the loss.

Question 81Strategy, Finance & Vendors⚑ Flag

Brookfield Clinics is signing a five-year contract with a SaaS patient scheduling provider. The draft contract is silent on what happens to Brookfield's data when the contract ends. What clause is MOST important for the CISO to add?

AA clause letting Brookfield name the provider's security staff BData return in a usable format and certified deletion at exit CA clause requiring the provider to use the same cloud host for five years DA most-favored-customer clause on pricing for future renewals

Correct answer: B. Data return in a usable format and certified deletion at exit
Data ownership and exit terms ensure Brookfield gets its data back in a usable format and that the provider deletes remaining copies with proof. Locking the provider to one cloud host does nothing to protect Brookfield's data when the relationship ends.

Question 82Governance, Risk & Audit⚑ Flag

A CISO wants to build a three-year security roadmap using NIST CSF 2.0. Executives want to see where the company stands today and where it needs to be. What is the BEST approach?

AAdopt every CSF subcategory as a mandatory control in policy all at once BTarget the highest tier for every outcome and fund all gaps in the first year CCreate current and target profiles, then prioritize the gaps between them DStart with the Detect function, since detection always delivers the most value

Correct answer: C. Create current and target profiles, then prioritize the gaps between them
CSF profiles describe current and target outcomes, and the gaps between them can be prioritized by risk and business need into a roadmap. Aiming for the highest tier everywhere ignores risk appetite and budget limits.

Question 83Core Competencies⚑ Flag

The audit committee of a regional insurer wants the right to physically audit its hyperscale cloud provider's data centers. The provider does not allow individual customer audits of its facilities. The committee asks the CISO how it can gain assurance. What is the BEST approach?

AHire a private investigator to inspect the provider's buildings BReview independent attestations such as SOC 2 Type II and their scope CCancel the cloud contract and return all workloads to the insurer's data center DRely on the provider's word that its data centers are secure

Correct answer: B. Review independent attestations such as SOC 2 Type II and their scope
Large providers offer independent reports such as SOC 2 Type II and ISO/IEC 27001 certification, and the CISO should review their scope and the customer controls they assume. Taking the provider's word gives no real assurance, and leaving the cloud over audit access is an extreme reaction.

Question 84Core Competencies⚑ Flag

Which type of threat intelligence describes a specific, upcoming attack campaign, including the likely targets and timing, to help security managers prepare a response?

ATactical threat intelligence BHistorical threat intelligence CStrategic threat intelligence DOperational threat intelligence

Correct answer: D. Operational threat intelligence
Operational intelligence covers the nature, intent and timing of specific campaigns so managers can prepare defenses and response. Tactical intelligence focuses on technical indicators and attacker techniques used by analysts and tools.

Question 85Core Competencies⚑ Flag

The business continuity plan of a call center company assumes scenarios such as fire or flood that make a building unusable. The CEO asks whether the company is ready for a severe pandemic. What gap should the CISO highlight FIRST?

AThe plan may not cover prolonged absence of many staff BAlternate office leases may be too costly to keep up CThe data center may lack enough cooling capacity DBackup generators at each site may not be large enough

Correct answer: A. The plan may not cover prolonged absence of many staff
A pandemic usually leaves facilities intact but removes large numbers of staff for weeks or months. Plans need cross-training, remote work capacity, and succession arrangements. Facility-focused gaps such as generators or leases do not address the main pandemic risk.

Question 86Executive Leadership⚑ Flag

The CISO of Pellham Bank usually leads with a collaborative, consensus-building style. During an active cyberattack, the team waits for agreement before acting. What leadership adjustment is MOST appropriate?

AKeep the consensus style so that every team member feels heard BHand all decisions to the most senior analyst on shift CAdopt a more directive style for the crisis, then return DPause the response until the team reaches full agreement

Correct answer: C. Adopt a more directive style for the crisis, then return
Situational leadership means adapting style to the context, and a crisis calls for clear, directive decisions to keep the response moving. Staying with consensus during an active attack wastes time when delay directly increases harm.

Question 87Security Program & Operations⚑ Flag

An identity management project has a budget at completion of $1,200,000 and a current cost performance index of 0.8. The CFO asks the CISO to forecast the final cost if current cost performance continues. What is the estimate at completion?

A$1,500,000 B$1,440,000 C$1,200,000 D$960,000

Correct answer: A. $1,500,000
When current cost performance is expected to continue, estimate at completion equals budget at completion divided by CPI: $1,200,000 / 0.8 = $1,500,000. Multiplying by CPI instead gives $960,000, which wrongly suggests a lower cost for a project that is overspending.

Question 88Core Competencies⚑ Flag

In a data center power design that includes both an uninterruptible power supply and a diesel generator, what is the PRIMARY role of the uninterruptible power supply?

ATo replace the need for any utility power feed at the data center BTo reduce the monthly electricity bill by storing off-peak energy CTo provide power for several days during a long regional outage DTo bridge the gap until the generator starts and carries the load

Correct answer: D. To bridge the gap until the generator starts and carries the load
A UPS supplies short-term battery power so systems stay up during the seconds or minutes before the generator takes over. Long outages are covered by the generator and its fuel supply, not the UPS batteries.

Question 89Governance, Risk & Audit⚑ Flag

A CISO at a retail company uses COBIT 2019 to show how security work supports the business. The CEO's top goal is faster expansion into new markets. Which COBIT concept BEST helps the CISO link this goal to security and IT priorities?

AThe goals cascade BThe RACI chart CThe control objectives list DThe capability levels

Correct answer: A. The goals cascade
The COBIT 2019 goals cascade translates stakeholder needs into enterprise goals, then alignment goals, then governance and management objectives. Capability levels measure process performance but do not link business goals to priorities.

Question 90Strategy, Finance & Vendors⚑ Flag

A vendor hosting the online store for Juniper Outdoor proposes an SLA that says it will use best efforts to restore service promptly after an outage. The online store produces most of the company's revenue. What is the GREATEST problem with this SLA?

AIt does not let Juniper staff log in to the vendor's hosting servers BIt does not describe the vendor's backup technology in enough detail CIt does not set measurable targets such as uptime and recovery times DIt does not require the vendor to host the store in the same country

Correct answer: C. It does not set measurable targets such as uptime and recovery times
An SLA must contain measurable targets, such as availability percentages and recovery times, tied to business needs, so performance can be measured and enforced. Details of backup technology may be useful, but they do not create an enforceable service commitment.

Question 91Executive Leadership⚑ Flag

Kinross Media is restructuring, and the security team will lose three roles. Rumors are spreading, and productivity has dropped. What is the BEST action for the CISO?

ASay nothing until HR completes every part of the process BTell the team that no further changes will happen this year CAsk the team to ignore the rumors and focus on daily tasks DShare what can be shared honestly and explain the next steps

Correct answer: D. Share what can be shared honestly and explain the next steps
Honest, timely communication within HR and legal limits reduces uncertainty and keeps trust during a reorganization. Promising no further changes may turn out false and would badly damage the CISO's credibility.

Question 92Core Competencies⚑ Flag

Architects at an online lender argue that traffic between servers inside the data center does not need encryption because the network is trusted. The lender is adopting a zero trust strategy. Some of the internal traffic carries loan applicant financial data. What should the CISO require?

ALeave internal traffic unencrypted because the perimeter firewall blocks outsiders BEncrypt internal traffic only after an attacker has been detected inside CEncrypt only traffic that leaves the country, since local traffic is low risk DEncrypt sensitive internal traffic, since internal networks are not trusted by default

Correct answer: D. Encrypt sensitive internal traffic, since internal networks are not trusted by default
Zero trust assumes the internal network may be compromised, so sensitive data in transit should be encrypted, for example with mutual TLS. Relying on the perimeter firewall reflects the old trusted network model, and waiting for a detected breach is too late.

Question 93Core Competencies⚑ Flag

A regional credit union with a small security team wants better insight into threats. The CIO proposes building an in-house threat intelligence unit with three new hires. Budget is tight, and the team has no intelligence experience. What is the BEST recommendation?

AHire the three analysts and have them build custom tools from scratch BUse a managed intelligence service matched to defined needs for now CSkip threat intelligence because only large banks can benefit from it DAsk the IT help desk to search social media for threats in spare time

Correct answer: B. Use a managed intelligence service matched to defined needs for now
A managed service, scoped to the credit union's defined needs, delivers useful intelligence at lower cost while internal maturity grows. Building a full in-house unit without experience or budget is premature and likely to fail.

Question 94Core Competencies⚑ Flag

A peer company in the same industry lost weeks of operations after attackers encrypted both its production systems and its online backups. The CEO asks the CISO whether the same thing could happen to them. What should the CISO do FIRST?

ABuy a second backup product from a different vendor for redundancy BIncrease the cyber insurance limit to cover several weeks of downtime CCheck that critical backups are isolated and that restores are tested DAsk the backup vendor for written assurance that its product is secure

Correct answer: C. Check that critical backups are isolated and that restores are tested
Cyber resilience depends on backups that attackers cannot reach and on restores that have been proven to work for critical services. Adding insurance transfers some of the financial loss, but it does not restore operations or reduce the chance of a long outage.

Question 95Governance, Risk & Audit⚑ Flag

A new CISO at a mid-sized hospital is asked to choose a security framework. The IT director pushes for one he used at a previous defense contractor. What should MOST influence the CISO's choice?

AThe framework the IT director already knows from his past work BThe hospital's regulatory duties, business goals and risk profile CThe framework with the largest number of detailed controls listed DThe framework most often named in security vendor marketing

Correct answer: B. The hospital's regulatory duties, business goals and risk profile
A framework should fit the organization's legal obligations, business objectives and risks, which for a hospital include health privacy rules. Familiarity from a different industry is convenient but may not address the hospital's actual requirements.

Question 96Security Program & Operations⚑ Flag

The CISO of Pelham Retail is negotiating a three-year contract with a new MSSP. The previous provider made switching difficult by withholding log data and detection rules. Legal asks which contract terms matter MOST in the new agreement. What should the CISO prioritize?

AA clause allowing the MSSP to subcontract monitoring BAutomatic renewal to avoid future procurement effort CExit terms covering data return and transition support DA lower monthly fee locked in for the full three years

Correct answer: C. Exit terms covering data return and transition support
Exit terms that require return of logs and detection content plus transition support protect continuity and prevent lock-in, which was the past problem. A locked-in low fee helps the budget but does nothing if the organization cannot leave without losing its security data.

Question 97Core Competencies⚑ Flag

A marketing agency gives new hires full system access on their first morning. Signed acceptable use and confidentiality agreements often arrive weeks later, and some never arrive. The CISO wants to fix the onboarding process. What is the BEST change?

ASend reminder emails to new hires who have not returned their signed agreements BMake signed agreements and security acknowledgments a condition before access CHold a yearly session where all staff re-sign the agreements at the same time DStore unsigned agreements in the HR file and treat them as accepted by default

Correct answer: B. Make signed agreements and security acknowledgments a condition before access
Requiring signed agreements before access is granted ensures employees accept their obligations, which supports later enforcement. Reminder emails may improve return rates, but access would still be granted without any formal acceptance.

Question 98Executive Leadership⚑ Flag

During a competitive selection for a new SIEM platform at Ardent Capital, one bidding vendor invites the CISO on an all-expenses-paid trip to a resort conference. What should the CISO do?

AAccept, since attending conferences is part of professional development BAccept, but disclose the trip after the contract has been awarded CDecline and follow the company's gift and procurement policy DAsk the vendor to extend the same offer to the other bidders

Correct answer: C. Decline and follow the company's gift and procurement policy
Accepting a valuable gift from a bidder during procurement creates at least the appearance of bias, so the CISO should decline and follow company policy. Disclosing after the award does not remove the conflict that existed while the decision was being made.

Question 99Strategy, Finance & Vendors⚑ Flag

A critical vendor that processes payment data for Ashford Retail has no independent audit report. Its questionnaire answers are vague and some conflict with its public documentation. The vendor sits in the highest risk tier. What should the CISO do NEXT?

AConduct an on-site or independent assessment of the vendor's controls BLower the vendor's risk tier until an audit report becomes available CAccept the questionnaire since the vendor signed it as accurate DSend the same questionnaire again and ask for clearer answers

Correct answer: A. Conduct an on-site or independent assessment of the vendor's controls
For a top-tier vendor with no independent assurance and unreliable self-reported answers, a direct on-site or third-party assessment provides the evidence needed. Resending the questionnaire is tempting, but it still depends on self-reporting that has already proven unreliable.

Question 100Core Competencies⚑ Flag

A review at a telecom provider finds that its internal certificate authority was set up by one administrator years ago. There is no certificate policy or practice statement. The root CA private key sits on an online server with no hardware protection. What should be the CISO's GREATEST concern?

ASome certificates have validity periods that are longer than the team would prefer BThe administrator has not documented the server's hardware model CThe certificate authority software uses an older user interface DCompromise of the root key would undermine trust in every issued certificate

Correct answer: D. Compromise of the root key would undermine trust in every issued certificate
If the root private key is stolen, an attacker could issue trusted certificates for any system, so the whole PKI would lose its trust. That calls for an offline root, HSM protection and a documented certificate policy, while the other issues are minor by comparison.

Question 101Governance, Risk & Audit⚑ Flag

At Ridgecrest Health, the security team keeps its own cyber risk register, separate from the enterprise risk register that the executive committee reviews each quarter. Most cyber risks list the security team as the owner. Executives rarely discuss cyber risk alongside other business risks. What should the CISO do?

AMove top cyber risks into the enterprise register with executive owners BEmail the full cyber risk register to all executives every single month CKeep the two registers apart so that cyber risk gets focused attention DAsk internal audit to take over maintaining the cyber risk register now

Correct answer: A. Move top cyber risks into the enterprise register with executive owners
Placing significant cyber risks in the enterprise register, owned by the executives whose areas they affect, lets leaders weigh them against other business risks through one process. Emailing the full cyber register adds detail but keeps cyber risk outside the forum where executives actually make risk decisions.

Question 102Core Competencies⚑ Flag

During planning for an annual penetration test, the owner of the core billing system asks to exclude it from scope because of a disruption during last year's test. The billing system holds the company's most sensitive financial data. What should the CISO do?

AAgree right away and remove the billing system from all future test cycles BTest the billing system secretly without telling its business owner CKeep the system in scope with safeguards, or get formal risk acceptance DPostpone the whole penetration test until the owner changes their mind

Correct answer: C. Keep the system in scope with safeguards, or get formal risk acceptance
Keeping the system in scope with controls such as agreed windows and safe methods tests the most sensitive asset, and any exclusion should be a documented risk acceptance by the owner. Testing it secretly would break the rules of engagement and could cause unauthorized disruption.

Question 103Core Competencies⚑ Flag

The audit committee of a manufacturing company suspects that a senior vice president has been manipulating financial records. Litigation and possible criminal referral are likely. The internal security team reports to the vice president's peer. What should the CISO recommend?

AHave the internal team image the executive's devices without delay BAsk the executive's own manager to review the records informally CMonitor the executive's email quietly until there is more evidence DEngage independent outside forensic experts through legal counsel

Correct answer: D. Engage independent outside forensic experts through legal counsel
Independent outside experts, engaged through counsel, provide impartiality, protect privilege, and can testify credibly if the case goes to court. An internal team with reporting ties to the subject creates conflict of interest concerns that opposing counsel could exploit.

Question 104Executive Leadership⚑ Flag

The CISO of Breckland Foods is leading a tender for managed detection services. The CISO learns that a close family member is a senior executive at one of the bidding firms. What is the BEST action?

AQuietly remove that firm from the tender to avoid any appearance of bias BKeep the relationship private since it does not affect the CISO's judgment CContinue leading the tender while scoring that bidder with extra care DDisclose the relationship and step back from the selection decision

Correct answer: D. Disclose the relationship and step back from the selection decision
Formal disclosure and recusal protect the integrity of the decision and the CISO's reputation. Quietly removing the firm is also a biased act and unfair to the bidder, and it hides the conflict instead of handling it openly.

Question 105Security Program & Operations⚑ Flag

The in-house SOC at Merritt Insurance runs 24x7 with 12-hour rotating shifts. Analyst turnover has reached 40 percent a year, and night-shift alert handling has declined in quality. Exit interviews cite fatigue and repetitive work. What should the CISO address FIRST?

ARaise salaries for the night-shift analysts only BRedesign the shift model and rotate analyst duties CHire more junior analysts to replace those who leave DMove all night-shift monitoring to an MSSP immediately

Correct answer: B. Redesign the shift model and rotate analyst duties
Fatigue from long rotating shifts and repetitive work is the root cause named in exit interviews, so redesigning the shift pattern and rotating duties targets it directly. Hiring replacements without fixing the conditions only keeps the turnover cycle going.

Question 106Core Competencies⚑ Flag

A senior chemist with access to unreleased product formulas has resigned to join a competitor. HR plans a standard exit process. The CISO wants to protect the company's trade secrets. Which step is MOST important in the separation process?

AAsk the chemist to complete an anonymous survey about workplace satisfaction BRemind the chemist of ongoing confidentiality duties and recover all assets CHave the chemist train a replacement for several months before departing DPost a notice to all staff that the chemist is leaving to join a competitor

Correct answer: B. Remind the chemist of ongoing confidentiality duties and recover all assets
A formal exit that restates confidentiality obligations and recovers devices, badges and documents reduces the chance that trade secrets leave with the employee. A satisfaction survey is useful for HR but does nothing to protect sensitive information.

Question 107Strategy, Finance & Vendors⚑ Flag

For years, the security budget at Calloway Foods has been set by adding 5% to the prior year's amount. The new CFO wants to adopt zero-based budgeting for every department, starting with security. What does this approach require the CISO to do?

AStart from last year's budget and justify only the new requests BCut the budget to zero and rebuild it only from compliance needs CSet the budget as a fixed share of total company revenue each year DJustify every budget line from zero based on its current value

Correct answer: D. Justify every budget line from zero based on its current value
Zero-based budgeting requires each expense to be justified for the coming period, regardless of past spending, which exposes legacy costs that no longer reduce risk. Justifying only new requests describes incremental budgeting, which is the practice the CFO wants to replace.

Question 108Governance, Risk & Audit⚑ Flag

A hospital wants to move patient scheduling, which includes protected health information, to a new cloud vendor. The vendor's sales team says a contract is ready to sign this week. What must the CISO ensure is in place before any PHI is shared?

AWritten approval from the vendor's compliance officer BA SOC 1 report covering the vendor's financial controls CA signed business associate agreement with the vendor DA mutual nondisclosure agreement between both parties

Correct answer: C. A signed business associate agreement with the vendor
HIPAA requires a business associate agreement before a vendor creates, receives, maintains or transmits PHI for a covered entity. A nondisclosure agreement does not contain the safeguards and obligations that HIPAA requires.

Question 109Executive Leadership⚑ Flag

The COO of Hollis Payments asks the CISO to sign an annual compliance attestation stating that all required controls are in place. The CISO knows two required controls are not yet working. What should the CISO do?

ARefuse to sign and also report the COO to the regulator immediately BDecline to sign as written and disclose gaps with fix plans CSign it, since both controls will be finished within a few months DSign it, but tell the COO privately about the two missing controls

Correct answer: B. Decline to sign as written and disclose gaps with fix plans
Signing a false attestation is unethical and may create personal legal liability, so the CISO should disclose the gaps with clear remediation plans. Reporting the COO to the regulator right away skips internal governance, which can correct the attestation before anything false is submitted.

Question 110Core Competencies⚑ Flag

An internal audit at an e-commerce company finds that an application encrypts customer records in its database. However, the encryption keys are stored in a configuration table in the same database. The development lead says the data is encrypted, so it is protected. What should be the CISO's GREATEST concern?

AThe keys might be too long for the application to process quickly BDevelopers may need extra training on how the database works CAnyone who steals the database also gets the keys to decrypt it DThe encryption may slow down database queries during peak sales

Correct answer: C. Anyone who steals the database also gets the keys to decrypt it
Storing keys with the data they protect means a single breach exposes both, so the encryption adds little real protection. Keys should be held separately, such as in a key management service or HSM, while performance and training are secondary issues.

Question 111Core Competencies⚑ Flag

During a disaster recovery test at Linwood Bank, the core banking application was restored within its target time but could not be used for six more hours. Staff could not log in because the identity and DNS services were scheduled to be restored last. The CIO asks the CISO what to change. What is the BEST recommendation?

AMap dependencies and set a recovery order with shared services first BBuy faster backup hardware so that all systems restore at the same time CRun the next test without identity services to save time on recovery DShorten the recovery time objective for the core banking application

Correct answer: A. Map dependencies and set a recovery order with shared services first
Applications rely on shared services such as identity, DNS and networking, so recovery plans must restore those first, based on a documented dependency map. Faster hardware may speed restores, but it does not fix a recovery order that leaves applications unusable.

Question 112Core Competencies⚑ Flag

A former employee has sued a technology company, and the legal department has issued a legal hold. The CISO learns that the email system automatically deletes messages older than 90 days. What should the CISO do FIRST?

AChange the retention policy for all users to keep email forever BSuspend automatic deletion for in-scope data, in coordination with legal CWait until legal sends a written list of the specific emails it needs DExport all company email to offline storage as a precaution

Correct answer: B. Suspend automatic deletion for in-scope data, in coordination with legal
Once a legal hold is issued, routine deletion of relevant data must stop right away, with scope set by legal, to avoid spoliation of evidence. Exporting or retaining everything goes far beyond the hold, raises cost, and creates new privacy and discovery exposure.

Question 113Security Program & Operations⚑ Flag

The CFO of Arden Manufacturing proposes setting the security budget at 10 percent of IT spending each year, citing an industry survey. The company recently added connected factory systems and expects stricter customer security requirements. What is the GREATEST concern with this approach?

ASurvey figures may not match the company's own risks and plans BThe percentage will be hard to calculate when IT spending shifts CSecurity staff may push for a higher share than the survey shows DIndustry surveys often report figures that are a year or two old

Correct answer: A. Survey figures may not match the company's own risks and plans
Benchmark percentages can be a useful sanity check, but they ignore the company's own threats, assets and obligations, such as its new factory systems. Budgets should be built from the risks and initiatives that need funding, and the age of a survey is a minor issue by comparison.

Question 114Core Competencies⚑ Flag

An insider threat analyst alerts the CISO that a sales manager has downloaded large amounts of customer data in the past week. The CISO's first instinct is to call the manager in and ask about it. The company has a documented insider threat program. What should the CISO do?

AConfront the manager directly to get an explanation before the data leaves BDisable the manager's account at once and announce an investigation to staff CFollow the program's escalation process with HR and legal and preserve evidence DAsk the analyst to keep monitoring quietly and take no action for another month

Correct answer: C. Follow the program's escalation process with HR and legal and preserve evidence
The documented process, with HR and legal involved, protects the employee's rights, preserves evidence and keeps any action defensible. Confronting the manager directly could tip off a real insider and weaken a later legal case.

Question 115Governance, Risk & Audit⚑ Flag

During a SOX audit, external auditors find that developers can push code changes directly into the production financial system without approval. The CFO asks how serious this is. What is the GREATEST concern for the CISO to raise?

AThe finding could delay the planned release of new system features BAuditors may ask for more developer access logs during next year's audit CDevelopers may become less productive once change approvals are required DIt may be judged a deficiency in internal control over financial reporting

Correct answer: D. It may be judged a deficiency in internal control over financial reporting
Unapproved changes to financial systems undermine IT general controls that support internal control over financial reporting, which SOX requires management to assess. Depending on severity, this could be reported as a significant deficiency or material weakness, which far outweighs productivity concerns.

Question 116Executive Leadership⚑ Flag

Delmont Pharmaceuticals, a public company, offers Priya the CISO role. The reporting line, budget and pay are already agreed. Priya is worried about recent cases where regulators pursued security leaders personally over company disclosures. What is MOST important for her to confirm before accepting?

AThat her job description lists every regulation she must oversee BThat she may hire outside counsel at company expense at any time CThat she will never be asked to review public security statements DThat she is covered by the company's D&O insurance and indemnity

Correct answer: D. That she is covered by the company's D&O insurance and indemnity
Directors and officers insurance and indemnification protect executives against personal legal costs that arise from their work, which addresses the exposure Priya is worried about. Avoiding review of public security statements would not reduce her risk, since accurate disclosures depend on the CISO's input.

Question 117Strategy, Finance & Vendors⚑ Flag

Thornbury Legal is ending its contract with a document management vendor that had access to client files and integrations with internal systems. The new vendor goes live next week. What is MOST important for the CISO to confirm during offboarding?

AThat all vendor access is revoked and client data is returned or destroyed BThat the outgoing vendor's final invoice matches the contract terms CThat the vendor's staff sign a new nondisclosure agreement at exit DThat the outgoing vendor receives a performance review for its records

Correct answer: A. That all vendor access is revoked and client data is returned or destroyed
Offboarding must remove all vendor access, including accounts, keys and integrations, and make sure client data is returned or securely destroyed with proof. A new nondisclosure agreement adds little if the vendor still holds data and access.

Question 118Core Competencies⚑ Flag

Which threat does full-disk encryption on a server MOST effectively protect against?

AAn insider with valid access who copies data to a removable drive BTheft of the physical drive or server while it is powered off CAn attacker who logs in to the running server with stolen credentials DMalware that reads files through the operating system while it runs

Correct answer: B. Theft of the physical drive or server while it is powered off
Full-disk encryption protects data when the media is stolen or removed while powered off. Once the system is running and the disk is unlocked, anyone with valid or stolen access, including malware, can read the data normally.

Question 119Core Competencies⚑ Flag

A board asks the CISO whether the company's security operations center could detect and stop a determined, skilled attacker. Past penetration tests have only listed vulnerabilities on a few systems. What type of engagement BEST answers the board's question?

AA desk review of the company's written security policy set BA compliance audit against the payment card industry standard CAn automated vulnerability scan of all internet-facing systems DA red team exercise built around realistic attacker objectives

Correct answer: D. A red team exercise built around realistic attacker objectives
A red team emulates a real adversary pursuing set objectives, which tests detection and response, not just the presence of vulnerabilities. A vulnerability scan only lists weaknesses and says nothing about whether the SOC would notice an attack.

Question 120Core Competencies⚑ Flag

At a large law firm's corporate client, each e-discovery request takes weeks and costs heavily in outside fees because no one knows where relevant data is stored. The general counsel asks the CISO for help. Which initiative would BEST reduce this burden over time?

AHire contract staff to search systems each time a request arrives BBuy an e-discovery platform and load all company data into it CKeep a data inventory and retention schedule jointly with legal DMove all company data to one cloud storage provider

Correct answer: C. Keep a data inventory and retention schedule jointly with legal
A maintained data inventory and records retention schedule show where relevant data lives and make sure data is not kept longer than needed, which lowers e-discovery cost and time. A platform alone does not solve the problem of not knowing where the data is stored.

Question 121Governance, Risk & Audit⚑ Flag

A retailer's legacy point-of-sale server cannot meet a PCI DSS requirement until it is replaced next year. The assessor says the requirement must still be addressed for this assessment. What is the BEST approach?

ADocument a compensating control that meets the intent of the requirement BAccept the risk internally and skip that requirement for this year only CAsk the card brands to waive the requirement for all legacy systems DRemove the server from the assessment scope without telling the assessor

Correct answer: A. Document a compensating control that meets the intent of the requirement
PCI DSS allows compensating controls when a legitimate constraint prevents meeting a requirement, as long as they meet its intent and are documented and validated. Hiding the server from scope is dishonest, and internal acceptance does not satisfy the standard.

Question 122Security Program & Operations⚑ Flag

The CISO of Tilden Software sees mean time to respond (MTTR) rise from 4 hours to 11 hours over two quarters, while alert volume stays flat. The SOC manager suggests buying a faster endpoint tool to fix the problem. What should the CISO do FIRST?

AHire two more analysts to absorb the response workload BApprove the endpoint tool purchase to speed up response CFind where time is lost in the response workflow DChange the MTTR target to 12 hours to match current results

Correct answer: C. Find where time is lost in the response workflow
Analyzing the response workflow shows whether delays come from handoffs, approvals, staffing or tools before money is spent. Buying a tool first assumes the cause without evidence and may not move the metric at all.

Question 123Core Competencies⚑ Flag

A hospital relies on a staffing agency for temporary nurses and IT contractors who receive access to patient systems. The CISO learns the hospital has never confirmed how the agency screens its workers. What is the BEST action?

ARequire screening standards equal to the hospital's in the contract, with audit rights BLimit contractors to read-only access so the screening question becomes less important CRun the hospital's own background checks on each contractor on the first day of work DStop using temporary staff until the agency proves that every worker is fully trusted

Correct answer: A. Require screening standards equal to the hospital's in the contract, with audit rights
Contract terms that require screening equal to the hospital's own, plus the right to verify, hold the agency accountable before workers get access. Stopping all temporary staffing would disrupt patient care and is not a proportionate response.

Question 124Executive Leadership⚑ Flag

The CISO of Tamsin Logistics wants the executive team to be ready to make fast decisions during a major cyber incident. Most executives have never been part of one. What is the BEST way to prepare them?

ASend executives a copy of the full technical incident response plan BRun a tabletop exercise focused on executive decisions CArrange a vendor demo of the company's detection and response tools DHave the executives shadow SOC analysts for one full shift

Correct answer: B. Run a tabletop exercise focused on executive decisions
A tabletop exercise lets executives practice decisions such as disclosure, downtime, and stakeholder communication in a safe setting before a real crisis. Reading the full technical plan does not build decision-making skill and is too detailed for this audience.

Question 125Strategy, Finance & Vendors⚑ Flag

A business unit leader at Ellison Media moves customer data to a SaaS marketing platform and tells the CISO that security is now the vendor's job. The platform lets each customer set user roles, sharing settings and multifactor authentication. What is the BEST response from the CISO?

AExplain that Ellison still owns its data and its access settings BRequire the vendor to take over Ellison's user account management CAsk the vendor to sign a contract making it liable for any breach DAgree, since a SaaS provider is responsible for all security controls

Correct answer: A. Explain that Ellison still owns its data and its access settings
Under the shared responsibility model, a SaaS customer still owns its data and is responsible for configuring identity, access and sharing settings. Making the vendor liable through contract may shift some cost, but it does not secure the settings that Ellison controls.

Question 126Governance, Risk & Audit⚑ Flag

An internal auditor reports that the company lacks a data classification policy. The CISO knows the policy exists and was approved last year, but the auditor was given an outdated document set. What should the CISO do?

AIgnore the finding, since the auditor has clearly made a mistake BAccept the finding to avoid conflict, and quietly recreate the policy CProvide the approved policy as evidence and ask that the finding be revised DEscalate to the CEO and have the auditor removed from the engagement

Correct answer: C. Provide the approved policy as evidence and ask that the finding be revised
When a finding is factually wrong, management should provide evidence and work with the auditor to correct it through the normal process. Accepting an inaccurate finding distorts the audit record, and pressuring the auditor threatens audit independence.

Question 127Core Competencies⚑ Flag

Three weeks after a new DLP system was set to block mode, sales and finance leaders complain that it stops legitimate emails to clients and auditors. The COO asks the CISO to turn it off completely. Board members still expect strong data protection. What is the BEST response for the CISO?

AKeep every rule in block mode and tell users to request exceptions BTune rules with data owners and move unclear rules to monitor or coach mode CReplace the DLP product with a different vendor as soon as possible DTurn off DLP fully, as the COO asked, until the next annual budget review is complete

Correct answer: B. Tune rules with data owners and move unclear rules to monitor or coach mode
Tuning with data owners and using monitor or user coaching modes for unclear rules keeps protection while cutting false positives. Turning DLP off removes protection the board expects, and forcing block mode with exceptions keeps disrupting the business.

Question 128Core Competencies⚑ Flag

An independent researcher emails a retailer's support team about a flaw that exposes customer orders. The company has no process for outside reports, and the legal team suggests threatening the researcher with a lawsuit. What should the CISO recommend?

ASend the legal threat to discourage future contact from researchers BIgnore the email because the researcher was not hired by the company CPay the researcher a large sum right away to keep the issue quiet DFix the flaw and publish a disclosure policy with safe harbor terms

Correct answer: D. Fix the flaw and publish a disclosure policy with safe harbor terms
Fixing the flaw and adopting a vulnerability disclosure policy with safe harbor gives good-faith researchers a clear, legal path to report issues. Threatening the researcher risks public backlash and discourages reports that protect customers.

Question 129Executive Leadership⚑ Flag

The CISO of Tarrant Insurance personally approves every firewall rule change, new vendor review and data sharing request. Hundreds of low-risk requests now wait for weeks, and business units have started working around the process. What is the BEST way for the CISO to fix this?

ADelegate low-risk approvals within set limits and keep high-risk ones BHire an assistant to prepare each request so approvals move faster CDrop approval for any request that the business marks as urgent DApprove all pending requests at once to clear the whole backlog this week

Correct answer: A. Delegate low-risk approvals within set limits and keep high-risk ones
A documented delegation of authority lets trusted managers approve routine, low-risk requests within defined limits, while the CISO keeps higher-risk decisions and reviews delegated approvals from time to time. An assistant may speed preparation, but the CISO remains a single bottleneck for every decision.

Question 130Core Competencies⚑ Flag

A SIEM vendor tells the CISO of a hospital group that its next-generation platform will fix the SOC's poor detection rate. A review shows the current SIEM uses only a few of its features, and there are no documented detection use cases. What should the CISO do FIRST?

AApprove the new platform, since the vendor offers a migration discount BAssess whether gaps come from the tool, staffing, or missing use cases CAdd more analysts to the SOC so they can work the existing alerts DIssue a request for proposal to compare SIEM vendors on detection

Correct answer: B. Assess whether gaps come from the tool, staffing, or missing use cases
Before spending on new technology, the CISO should find the root cause of poor detection, which here points to missing use cases and process gaps, not the tool. Running an RFP is a reasonable later step, but buying any new SIEM will not fix a problem rooted in process.

Question 131Security Program & Operations⚑ Flag

An audit at Rowan Chemicals finds that server settings vary widely and nobody can say which configuration is approved. Several servers have security logging disabled. The CIO asks the CISO for a program-level fix. What is the BEST approach?

ASet approved baselines and monitor for configuration drift BRebuild every server from scratch over the next weekend CBlock all administrators from changing any server settings DRe-enable logging on the affected servers and close the finding

Correct answer: A. Set approved baselines and monitor for configuration drift
Approved secure baselines define the expected configuration, and drift monitoring detects deviations so they can be corrected. Re-enabling logging fixes the symptom on a few servers but does not prevent the same problem from recurring.

Question 132Core Competencies⚑ Flag

Executives at Meridale Engineering will travel to a country known for state-sponsored theft of intellectual property, where border officials may inspect devices. They plan to take their regular laptops and phones, which hold full design files and email history. What should the CISO recommend?

ATell executives to keep their devices with them at all times abroad BInstall extra antivirus software on their usual laptops before travel CCancel the trip because the country is too risky for business travel DIssue clean loaner devices with only the data needed for the trip

Correct answer: D. Issue clean loaner devices with only the data needed for the trip
Clean loaner devices limit what can be copied or tampered with, and they can be wiped or examined on return before they reconnect to the network. Keeping devices close helps, but it does not protect data during a border inspection.

Question 133Governance, Risk & Audit⚑ Flag

Internal audit reports that the same three security findings have appeared in each of the last three annual audits. Each year, owners agreed to fix them, but nothing changed. What is the BEST way for the CISO to stop this pattern?

ATrack remediation centrally with owners and dates, reporting to the audit committee BFix all three findings personally using the security team's own staff and budget CRaise the severity of the findings each year so that owners take them more seriously DAsk internal audit to stop reporting findings that management has already accepted

Correct answer: A. Track remediation centrally with owners and dates, reporting to the audit committee
Central tracking with accountable owners, due dates and regular reporting to the audit committee gives oversight and pressure to finish remediation. Fixing everything with security staff removes owner accountability, and suppressing findings undermines the audit process.

Question 134Executive Leadership⚑ Flag

A regional sales director at Hartwell Distribution wants to accept the risk of running an unsupported customer database for another year. The risk would exceed the company's stated appetite. What should the CISO do?

AShut down the database immediately without consulting the business BAccept the risk on behalf of the company to keep sales moving CEscalate it to an executive with authority to accept that risk level DLet the sales director accept the risk, since they own the database

Correct answer: C. Escalate it to an executive with authority to accept that risk level
Risk above appetite must be accepted by someone with the matching authority, often a senior executive or risk committee, and documented. Letting the sales director accept it would bypass the governance the board set for risks of this size.

Question 135Strategy, Finance & Vendors⚑ Flag

At Corvin Engineering, business units often buy SaaS tools with corporate credit cards, and the security team learns about them only after incidents. The CISO wants to reduce this risk without blocking the business. What is the BEST long-term approach?

ABuild a security review step into procurement and card approval BAsk employees to report any SaaS tool they use once each year CCancel corporate credit cards for all business unit managers DBlock all SaaS websites at the firewall except an approved list

Correct answer: A. Build a security review step into procurement and card approval
Adding a risk-based security review to procurement and purchasing catches new SaaS vendors before data is shared, while still letting the business buy what it needs. Blocking everything at the firewall is too technical and heavy-handed and pushes users to find workarounds.

Question 136Core Competencies⚑ Flag

Larchmont Labs is building a new research headquarters. Architects will finalize the floor plans next month, and security has not been involved. The facilities director plans to add cameras and badge readers after construction ends. What should the CISO do FIRST?

AOrder cameras and badge readers now so they arrive before move-in BHire a guard company to staff every entrance once the site opens CWait until construction ends and then audit the finished building DEngage the architects now to build security zones into the design

Correct answer: D. Engage the architects now to build security zones into the design
Building security into the design, such as zoned areas, controlled entry points, lighting and clear sightlines, is far cheaper and more effective than retrofitting after construction. Ordering cameras early still bolts security onto a layout that may not support it.

Question 137Core Competencies⚑ Flag

A global company uses three cloud providers, and each product team designs its own security controls. Audits find inconsistent logging, identity and encryption practices across teams. The CISO wants consistency without slowing every project. What is the BEST approach?

AAssign one security engineer to rebuild every team's environment alone BApprove one reference security architecture with reusable design patterns CRequire every team to move all workloads back to on-premises data centers DLet each team keep its own design but submit a yearly self-assessment

Correct answer: B. Approve one reference security architecture with reusable design patterns
A reference architecture gives teams pre-approved, reusable patterns, which creates consistency and speeds delivery. Yearly self-assessments keep the current inconsistency and only document it after the fact.

Question 138Core Competencies⚑ Flag

The security team at a telecommunications company wants to send every available log source into the SIEM, which is licensed by data volume. The projected cost exceeds the monitoring budget by 60 percent. What is the BEST approach?

ASend every log source anyway and request emergency budget mid-year BCollect only the firewall logs, since they cover the network edge CRank sources by critical assets and use cases, archiving the rest DDrop the SIEM and rely on each system's own local log storage

Correct answer: C. Rank sources by critical assets and use cases, archiving the rest
Log sources should be ranked by the assets they protect and the detection use cases they support, while lower-value logs go to cheaper archive storage for investigations. Collecting only firewall logs leaves major blind spots on endpoints, identity, and applications.

Question 139Security Program & Operations⚑ Flag

A year ago, Brookhaven Credit Union funded a $600,000 privileged access management project based on a business case that promised fewer standing admin accounts and faster audits. The project closed on time and on budget. The board asks whether the investment paid off. What should the CISO do?

AReport the on-time, on-budget close as proof that it delivered value BMeasure the promised outcomes against the business case baselines CSurvey IT staff on whether they find the new tool easy to work with DPropose a second phase that extends the tool to many more systems

Correct answer: B. Measure the promised outcomes against the business case baselines
Benefits realization compares actual outcomes, such as the number of standing admin accounts and the effort spent on audits, with the baselines and targets in the business case. Finishing on time and on budget shows good delivery, but it does not show that the expected risk reduction happened.

Question 140Core Competencies⚑ Flag

A government contractor's data classification scheme has seven levels with overlapping definitions. Staff often pick the highest level to be safe, which drives up protection costs and blocks normal sharing. What should the CISO recommend?

AMake the highest level the default so that no data is ever under-protected BLet each department create its own set of levels that suits its daily work CKeep all seven levels but require staff to complete more training on the definitions DSimplify the scheme to a few clearly defined levels based on business impact

Correct answer: D. Simplify the scheme to a few clearly defined levels based on business impact
A small number of clearly defined levels tied to impact makes classification easier and reduces over-classification. More training on seven overlapping levels does not fix definitions that are confusing by design.

Question 141Governance, Risk & Audit⚑ Flag

A CISO is reviewing a SOC 2 Type II report from a cloud file-sharing vendor. The report has no exceptions, but it lists several complementary user entity controls, such as reviewing user access each quarter. What does this mean for the CISO's company?

AThe vendor will perform those controls for the company at extra cost BThe company must operate those controls itself to rely on the report CThe controls are optional suggestions that the auditor recommends DThe report is invalid until the vendor implements those controls

Correct answer: B. The company must operate those controls itself to rely on the report
Complementary user entity controls are controls the customer must operate for the vendor's control objectives to be achieved. If the company does not perform them, it cannot fully rely on the clean report.

Question 142Executive Leadership⚑ Flag

The CISO of Quarry Lane Software has had a senior analyst role open for nine months. The posting requires ten years of experience, five certifications, and a computer science degree. What is the BEST first step?

APost the same job on more recruiting websites to reach more people BAsk the current team to cover the work until a perfect match appears CRewrite the posting around essential skills and drop extra criteria DRaise the salary range while keeping all the posted requirements

Correct answer: C. Rewrite the posting around essential skills and drop extra criteria
Unrealistic requirements shrink the candidate pool and screen out capable people, so focusing the posting on essential skills widens it. Posting the same job on more sites spreads a posting that still discourages qualified applicants.

Question 143Strategy, Finance & Vendors⚑ Flag

A reassessment of a critical billing vendor at Selwyn Water finds serious control weaknesses. The business depends on the vendor and replacing it would take at least a year. The billing manager asks the CISO to approve continued use. What should the CISO do?

ARequire a dated remediation plan and have the business owner accept the risk BKeep the findings within the security team to protect the vendor relationship CApprove continued use since the business cannot replace the vendor DTerminate the contract at once and accept the business disruption

Correct answer: A. Require a dated remediation plan and have the business owner accept the risk
The right path is to require a remediation plan with deadlines, apply compensating controls where possible, and have the accountable business owner formally accept the remaining risk. Approving use without conditions is tempting, but the CISO should not quietly absorb a risk that belongs to the business owner.

Question 144Core Competencies⚑ Flag

A healthcare payer has replaced member ID numbers with tokens across most of its systems. A single token vault now maps every token back to the real member data. The project team plans to give the vault the same controls as other internal servers. What should be the CISO's GREATEST concern?

ASome legacy systems may not accept tokens in their existing data fields and reports BThe tokenization vendor may raise license fees next year CTokens may make reports harder for analysts to read DThe token vault is now a high-value target needing the strongest controls

Correct answer: D. The token vault is now a high-value target needing the strongest controls
Tokenization concentrates risk in the vault, because whoever compromises it can reverse every token, so it needs the strongest access, monitoring and protection controls. Reporting, legacy field formats and license costs are operational issues, not the main security risk.

Question 145Core Competencies⚑ Flag

Developers at Hollins Insurance copy full production databases, including customer health and payment details, into test environments to reproduce bugs. Test systems have weaker access controls, and many contractors use them. The development director says realistic data is essential. What is the BEST approach?

AProvide masked or synthetic data that keeps realistic test value BBan contractors from any test environment that holds customer data CLet developers copy production data only with a manager's approval DApply production-level controls to every test environment right away

Correct answer: A. Provide masked or synthetic data that keeps realistic test value
Masked or synthetic data keeps the structure developers need while removing real personal details, so a breach of a test system does not expose customers. Raising every test environment to production controls is costly and still spreads real data across more places.

Question 146Core Competencies⚑ Flag

The SOC manager at a logistics firm tells the CISO that the firm now has detection rules covering 85 percent of relevant MITRE ATT&CK techniques. The CISO plans to share this figure with the board. What is the GREATEST concern with presenting it?

AThe figure may fall as new techniques get added to ATT&CK BPeer companies may report higher coverage than this one CRule coverage does not prove the rules detect real attacks DBoards are not familiar with the ATT&CK framework's terms

Correct answer: C. Rule coverage does not prove the rules detect real attacks
Mapped coverage shows that rules exist, not that they work, so it should be validated through testing such as purple team exercises before being presented as assurance. The framework's terms can be explained in plain language, but an unvalidated figure can give the board false confidence.

Question 147Security Program & Operations⚑ Flag

The CISO of Brixton Logistics has approved a SOAR platform, and documented playbooks are already in place. The SOC manager asks which processes to automate first. What is the BEST guidance?

AComplex investigations that need the most judgment BContainment actions on critical production systems CRarely used processes that analysts tend to forget DHigh-volume, repeatable tasks with low impact if wrong

Correct answer: D. High-volume, repeatable tasks with low impact if wrong
Starting with high-volume, repeatable, low-impact tasks such as alert enrichment frees analyst time quickly while limiting harm if automation misfires. Automating containment on critical production systems first risks business disruption from false positives before the team trusts the automation.

Question 148Core Competencies⚑ Flag

A public company classifies its quarterly earnings figures as restricted until they are released. After release, the files keep their restricted label and strict controls, which slows investor relations work. What should the CISO add to the classification standard?

AA requirement that investor relations staff request an exception for each file BA process for the IT team to remove labels from any file older than ninety days CA rule that all financial data stays restricted permanently to avoid any risk DReview and reclassification triggers so labels change when data sensitivity changes

Correct answer: D. Review and reclassification triggers so labels change when data sensitivity changes
Classification should follow the data's life cycle, so the standard needs triggers such as a public release for the data owner to reclassify. Keeping everything restricted forever wastes resources and slows legitimate work.

Question 149Governance, Risk & Audit⚑ Flag

A European e-commerce company must appoint a data protection officer under GDPR. The CEO suggests the CISO also take the DPO role, since the CISO already manages security. What is the GREATEST concern with this plan?

AThe CISO would need a law degree to legally hold the DPO role in Europe BThe roles could conflict, which may weaken the DPO's required independence CGDPR forbids any single person from holding more than one job title DThe DPO must be an outside contractor rather than a company employee

Correct answer: B. The roles could conflict, which may weaken the DPO's required independence
GDPR allows the DPO to hold other tasks only if they do not create a conflict of interest, and roles that decide how data is processed, such as running security operations, can conflict. The DPO may be an employee or a contractor, and no law degree is required.

Question 150Executive Leadership⚑ Flag

After recovering from a serious incident at Ivers Engineering, the CISO plans a post-incident review. Some executives want to identify and discipline the individuals who made mistakes. What approach should the CISO champion?

ASkipping the review to let staff move on from the incident BAn external review whose findings are kept from the security team CA blameless review that finds process and control gaps to fix DA disciplinary review to identify and remove those at fault

Correct answer: C. A blameless review that finds process and control gaps to fix
A blameless review encourages honest accounts, which reveal the process and control gaps that actually caused the incident. A disciplinary focus makes people defensive and hides the information needed to stop it from happening again.