CTO Cybersecurity Strategy & Governance 2

Question 1

A CTO is implementing a zero-trust security model. Which principle is MOST fundamental to this architecture?

Accepted Answer

Never trust, always verify regardless of network location

Answer

Zero-trust operates on the principle of 'never trust, always verify,' treating every access request as potentially hostile regardless of origin.

Question 2

Which framework is MOST commonly used to measure and communicate cybersecurity risk to a board of directors?

Accepted Answer

NIST Cybersecurity Framework

Answer

The NIST Cybersecurity Framework provides a common language and structure for communicating cybersecurity risk at an organizational level to executives and boards.

Question 3

A company experiences a data breach. In what order should incident response phases typically occur?

Accepted Answer

Identification, Containment, Eradication, Recovery

Answer

Standard incident response follows Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned in sequence.

Question 4

What is the PRIMARY purpose of a Security Information and Event Management (SIEM) system?

Accepted Answer

Aggregating and correlating security events for real-time analysis

Answer

A SIEM collects, aggregates, and correlates log data from across the organization to enable real-time threat detection and compliance reporting.

Question 5

Under GDPR, what is the maximum time an organization has to notify authorities of a personal data breach?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

(CTO) Certified Chief Technology Officer Practice Test

(CTO) Certified Chief Technology Officer Practice Test

CTO Cybersecurity Strategy & Governance 2