CCISO Security Program Development & Management 2

Question 1

A CISO is tasked with establishing security metrics for the board. Which metric BEST demonstrates the business value of the security program?

Accepted Answer

Reduction in mean time to detect (MTTD) and respond (MTTR) to incidents

Answer

MTTD and MTTR directly tie security operational efficiency to business risk reduction, making them meaningful to board-level stakeholders.

Question 2

When developing a security program charter, which element is MOST critical to include to ensure executive sponsorship?

Accepted Answer

Defined authority, scope, and accountability of the security function

Answer

A charter must define authority and scope so that executives understand and formally delegate responsibility to the CISO.

Question 3

A security program is failing to align with business objectives. What is the FIRST step a CISO should take to remediate this?

Accepted Answer

Conduct a stakeholder analysis to understand business priorities

Answer

Understanding stakeholder priorities is the foundation for aligning security investments with the business objectives that matter most.

Question 4

Which approach BEST describes integrating security into an organization's SDLC?

Accepted Answer

Embedding security requirements, reviews, and testing at every phase of development

Answer

A DevSecOps approach embeds security throughout all SDLC phases rather than treating it as a gate at the end.

Question 5

A CISO must justify a security budget increase to the CFO. Which financial model is MOST effective?

Accepted Answer

Return on security investment (ROSI) tied to risk reduction

Answer

ROSI frames security spending in terms of quantified risk reduction, which is the language most compelling to financial executives.

(CCISO) EC-Council Certified CISO Practice Test