CTO Cybersecurity Strategy & Governance 3

Question 1

Which metric BEST helps a CTO quantify the financial impact of a potential cybersecurity incident?

Accepted Answer

Annualized Loss Expectancy (ALE)

Answer

ALE (Annual Rate of Occurrence × Single Loss Expectancy) provides a financial estimate of expected losses from a given threat, enabling risk-based budget decisions.

Question 2

A CTO must decide between a public cloud and on-premises deployment for sensitive data. Which security consideration is UNIQUE to cloud environments?

Accepted Answer

Shared responsibility model for security controls

Answer

The shared responsibility model is unique to cloud, defining which security controls the provider manages versus which the customer must implement.

Question 3

What is the PRIMARY difference between a vulnerability assessment and a penetration test?

Accepted Answer

A penetration test actively exploits vulnerabilities; an assessment only identifies them

Answer

Vulnerability assessments identify and report weaknesses, while penetration tests actively attempt to exploit those weaknesses to demonstrate real-world impact.

Question 4

Which cryptographic concept ensures that a sender cannot deny having sent a message?

Accepted Answer

Non-repudiation

Answer

Non-repudiation, typically achieved through digital signatures, prevents a party from denying an action they performed.

Question 5

A CTO is establishing a cybersecurity governance committee. Who should TYPICALLY chair this committee?

Accepted Answer

The CISO or a senior security officer

Answer

The CISO typically chairs the cybersecurity governance committee, providing security expertise and accountability while liaising with executive leadership.

(CTO) Certified Chief Technology Officer Practice Test

(CTO) Certified Chief Technology Officer Practice Test

CTO Cybersecurity Strategy & Governance 3