CTO Cybersecurity Strategy & Governance 2 — Questions and Answers
Question 1: A CTO is implementing a zero-trust security model. Which principle is MOST fundamental to this architecture?
- Trust but verify all internal traffic
- Never trust, always verify regardless of network location (Correct answer)
- Perimeter-based security with strong firewalls
- Implicit trust for authenticated users within the network
Correct answer: Never trust, always verify regardless of network location
Zero-trust operates on the principle of 'never trust, always verify,' treating every access request as potentially hostile regardless of origin.
Question 2: Which framework is MOST commonly used to measure and communicate cybersecurity risk to a board of directors?
- OWASP Top 10
- NIST Cybersecurity Framework (Correct answer)
- CVE scoring system
- SANS Critical Controls
Correct answer: NIST Cybersecurity Framework
The NIST Cybersecurity Framework provides a common language and structure for communicating cybersecurity risk at an organizational level to executives and boards.
Question 3: A company experiences a data breach. In what order should incident response phases typically occur?
- Eradication, Containment, Identification, Recovery
- Identification, Containment, Eradication, Recovery (Correct answer)
- Containment, Identification, Recovery, Eradication
- Recovery, Identification, Containment, Eradication
Correct answer: Identification, Containment, Eradication, Recovery
Standard incident response follows Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned in sequence.
Question 4: What is the PRIMARY purpose of a Security Information and Event Management (SIEM) system?
- Blocking malware at the network perimeter
- Aggregating and correlating security events for real-time analysis (Correct answer)
- Managing user access and authentication
- Encrypting sensitive data at rest
Correct answer: Aggregating and correlating security events for real-time analysis
A SIEM collects, aggregates, and correlates log data from across the organization to enable real-time threat detection and compliance reporting.
Question 5: Under GDPR, what is the maximum time an organization has to notify authorities of a personal data breach?
- 24 hours
- 48 hours
- 72 hours (Correct answer)
- 7 days
Correct answer: 72 hours
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.
Question 6: A CTO wants to ensure third-party vendors don't introduce security risks. What is the BEST approach?
- Prohibit all third-party software integrations
- Conduct annual vendor security assessments and include security requirements in contracts (Correct answer)
- Rely solely on vendor self-certification
- Require vendors to use the same internal tools
Correct answer: Conduct annual vendor security assessments and include security requirements in contracts
A robust third-party risk management program combines contractual security obligations with periodic assessments to continuously validate vendor security posture.
Question 7: What does 'defense in depth' mean in a cybersecurity context?
- Using the strongest possible single security control
- Deploying multiple layered security controls so failure of one doesn't compromise the system (Correct answer)
- Focusing security resources on the most critical assets only
- Implementing deep packet inspection at the network boundary
Correct answer: Deploying multiple layered security controls so failure of one doesn't compromise the system
Defense in depth employs multiple overlapping security controls across different layers so that no single point of failure can compromise the entire system.
CTO Cybersecurity Strategy & Governance 2
A CTO is implementing a zero-trust security model.
Which principle is MOST fundamental to this architecture?