CTO Cybersecurity Strategy & Governance 4

Question 1

A CTO must align cybersecurity investments with business objectives. Which approach BEST achieves this?

Accepted Answer

Perform risk-based prioritization tying security spend to business-critical asset protection

Answer

Risk-based prioritization ensures security investments are proportional to the business value of assets and the likelihood and impact of threats against them.

Question 2

What distinguishes a security policy from a security standard?

Accepted Answer

Policies state high-level intent and requirements; standards define specific mandatory controls

Answer

Policies establish high-level principles and requirements, while standards provide specific, mandatory technical or procedural controls that implement policy intent.

Question 3

Which security testing method simulates an attack from someone with no prior knowledge of the system?

Accepted Answer

Black-box testing

Answer

Black-box testing simulates an external attacker with no prior knowledge of internal systems, architecture, or source code.

Question 4

A company stores customer payment data. Which compliance standard is MOST directly applicable?

Accepted Answer

PCI DSS

Answer

PCI DSS (Payment Card Industry Data Security Standard) specifically governs the storage, processing, and transmission of cardholder data.

Question 5

What is the PRIMARY goal of a cybersecurity tabletop exercise?

Accepted Answer

Training responders and identifying gaps in incident response plans through simulated scenarios

Answer

Tabletop exercises walk participants through simulated incident scenarios to test decision-making, communication, and identify gaps in response procedures without disrupting operations.

(CTO) Certified Chief Technology Officer Practice Test

(CTO) Certified Chief Technology Officer Practice Test

CTO Cybersecurity Strategy & Governance 4