CTO Cybersecurity Strategy & Governance 5

Question 1

What is the MOST significant cybersecurity risk introduced by shadow IT?

Accepted Answer

Unvetted systems outside security controls creating unknown attack surfaces

Answer

Shadow IT creates unmanaged systems that bypass security controls, vulnerability patching, and monitoring, introducing unknown and unmanaged attack surfaces.

Question 2

Which encryption standard is currently recommended by NIST for protecting sensitive US government data?

Accepted Answer

AES-256

Answer

NIST recommends AES-256 as the encryption standard for protecting sensitive and classified government information due to its strength against known attacks.

Question 3

A CTO wants to establish a security culture organization-wide. What is the MOST effective long-term approach?

Accepted Answer

Implementing continuous security awareness programs reinforced by leadership behavior

Answer

Sustained security culture requires continuous reinforcement through ongoing training, simulations, and visible leadership commitment rather than one-time interventions.

Question 4

What does 'cyber resilience' add beyond traditional cybersecurity?

Accepted Answer

The ability to anticipate, withstand, recover from, and adapt to adverse cyber events

Answer

Cyber resilience extends beyond prevention to encompass the organization's ability to maintain operations and recover quickly when security controls fail.

Question 5

Which role is PRIMARILY responsible for classifying data assets in a data governance framework?

Accepted Answer

Data owner (business unit leader)

Answer

Data owners, typically business unit leaders, are responsible for classifying data based on its business value and sensitivity, while IT implements the technical controls.

(CTO) Certified Chief Technology Officer Practice Test

(CTO) Certified Chief Technology Officer Practice Test

CTO Cybersecurity Strategy & Governance 5