CCISO Security Program Development & Management 5

Question 1

A CISO is asked to reduce the security budget by 20%. Which approach BEST demonstrates risk-informed decision-making?

Accepted Answer

Map proposed cuts to their risk impact and present the analysis to leadership

Answer

Mapping cuts to risk impact ensures leadership understands the consequences and makes an informed decision rather than the CISO absorbing the risk silently.

Question 2

Which of the following BEST describes the concept of 'security by design' in program management?

Accepted Answer

Incorporating security requirements and controls into systems from their initial design phase

Answer

Security by design means embedding security considerations from the earliest stages of system design rather than adding them after development.

Question 3

A CISO is implementing a security program for a recently acquired company. What is the MOST critical first step in integration?

Accepted Answer

Conducting a gap assessment comparing the acquired company's controls to parent company standards

Answer

A gap assessment reveals where the acquired company's security posture deviates from standards, enabling a risk-prioritized integration roadmap.

Question 4

What is the PRIMARY benefit of implementing a formal exception management process within a security program?

Accepted Answer

It provides a documented, risk-accepted path for business units that cannot immediately comply with policy

Answer

Exception management balances business agility with risk governance by formally documenting, approving, and tracking deviations from security policy.

Question 5

An organization's security program lacks integration with its enterprise risk management (ERM) framework. Which outcome is MOST likely?

Accepted Answer

Security risks will not be properly prioritized or reported alongside other enterprise risks

Answer

Without ERM integration, security risks are managed in isolation and may be under-resourced or misaligned with the organization's overall risk appetite.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Security Program Development & Management 5