CTO Cybersecurity Strategy & Governance 3 — Questions and Answers
Question 1: Which metric BEST helps a CTO quantify the financial impact of a potential cybersecurity incident?
- Mean Time to Detect (MTTD)
- Annualized Loss Expectancy (ALE) (Correct answer)
- Common Vulnerability Scoring System (CVSS)
- Number of security alerts per day
Correct answer: Annualized Loss Expectancy (ALE)
ALE (Annual Rate of Occurrence × Single Loss Expectancy) provides a financial estimate of expected losses from a given threat, enabling risk-based budget decisions.
Question 2: A CTO must decide between a public cloud and on-premises deployment for sensitive data. Which security consideration is UNIQUE to cloud environments?
- Need for encryption at rest
- Shared responsibility model for security controls (Correct answer)
- Requirement for access control policies
- Vulnerability patch management
Correct answer: Shared responsibility model for security controls
The shared responsibility model is unique to cloud, defining which security controls the provider manages versus which the customer must implement.
Question 3: What is the PRIMARY difference between a vulnerability assessment and a penetration test?
- Vulnerability assessments cost more than penetration tests
- A penetration test actively exploits vulnerabilities; an assessment only identifies them (Correct answer)
- Penetration tests are automated; vulnerability assessments are manual
- Vulnerability assessments require external testers; pen tests can be internal
Correct answer: A penetration test actively exploits vulnerabilities; an assessment only identifies them
Vulnerability assessments identify and report weaknesses, while penetration tests actively attempt to exploit those weaknesses to demonstrate real-world impact.
Question 4: Which cryptographic concept ensures that a sender cannot deny having sent a message?
- Confidentiality
- Integrity
- Non-repudiation (Correct answer)
- Availability
Correct answer: Non-repudiation
Non-repudiation, typically achieved through digital signatures, prevents a party from denying an action they performed.
Question 5: A CTO is establishing a cybersecurity governance committee. Who should TYPICALLY chair this committee?
- The CISO or a senior security officer (Correct answer)
- The Chief Financial Officer
- An external security auditor
- The IT helpdesk manager
Correct answer: The CISO or a senior security officer
The CISO typically chairs the cybersecurity governance committee, providing security expertise and accountability while liaising with executive leadership.
Question 6: What is the purpose of a Business Impact Analysis (BIA) in cybersecurity planning?
- Identifying and classifying all software vulnerabilities
- Determining the operational and financial impact of disruptions to critical business functions (Correct answer)
- Auditing employee compliance with security policies
- Mapping network topology for security monitoring
Correct answer: Determining the operational and financial impact of disruptions to critical business functions
A BIA identifies critical business processes, their dependencies, and the potential impact of disruptions to prioritize recovery efforts and set recovery objectives.
Question 7: Which approach BEST reduces the risk of insider threats in a large organization?
- Installing endpoint detection on all devices
- Implementing least-privilege access combined with user behavior analytics (Correct answer)
- Conducting background checks during hiring only
- Requiring all employees to sign NDA agreements
Correct answer: Implementing least-privilege access combined with user behavior analytics
Combining least-privilege access (limiting what insiders can access) with UBA (detecting anomalous behavior) provides both preventive and detective controls for insider threats.
CTO Cybersecurity Strategy & Governance 3
Which metric BEST helps a CTO quantify the financial impact of a potential cybersecurity incident?