Information Security Governance

Which capability maturity model (CMM) level indicates that security processes are proactively measured and optimized?

A CISO is building a business case for a new security tool. Which approach BEST quantifies the value of the investment?

An organization is updating its security governance framework. Which three elements are essential for ensuring board-level oversight?

During a security policy development lifecycle, which step should occur immediately after 'drafting' the policy?

A security manager wants to measure the effectiveness of the security awareness program. Which metric is most relevant?

A CISO reports to the CIO and provides regular security updates to the board audit committee. The CEO has delegated security accountability to the CFO. Which governance structure does this reflect?

Which of the following is the PRIMARY responsibility of the CISO in an organization?

What is the primary purpose of a security incident near-miss reporting culture?

Which of the following is the correct order in the security policy hierarchy, from highest to lowest level?

Which TWO factors are most important when prioritizing security investments? (Select TWO.)

A CISO is preparing a multi-year security roadmap. Which of the following is the MOST critical factor for ensuring the roadmap aligns with business strategy?

Which component is essential for building a strong security culture within an organization?

Which metric best indicates the effectiveness of a security awareness program in changing employee behavior?

A CISO is reporting to the board of directors. Which metric would BEST demonstrate the effectiveness of the security program in reducing business impact?

An organization is updating its security policy framework. The current enterprise security policy has not been reviewed in three years. What is the FIRST step in the policy development lifecycle?

A security manager is conducting a regulatory compliance review. Which THREE regulations are most likely to apply to a financial services company operating in the United States?

An organization has a decentralized governance model where each business unit manages its own security. What is a key challenge of this model?

An organization is implementing a hybrid governance model for information security. Which statement best describes this approach?

Which capability maturity model (CMM) level indicates that security processes are managed and measured using quantitative metrics?

Which capability maturity model (CMM) level indicates that security processes are measured and controlled?

A company is considering a policy exception that would allow temporary non-compliance with a data encryption standard due to a legacy system. What is the most important element of the exception management process?

Which governance structure is characterized by a single security team that serves the entire organization?

Which regulatory requirement mandates that organizations implement data protection measures for personal data of EU citizens?

Which of the following is the PRIMARY reason for aligning the information security program with business objectives?

A multinational organization must comply with GDPR, CCPA, and PCI DSS. The security manager is designing a compliance monitoring program. Which approach is MOST efficient?

Which of the following is the PRIMARY benefit of having a formal policy exception management process?

A CISO is reporting to the board on the effectiveness of the security programme. Which TWO metrics are MOST appropriate for board-level reporting? (Select TWO)

An organization's security strategy includes a goal to achieve CMM Level 3. What capability does the organization need to demonstrate?

An organization is developing a security policy for remote access. According to the policy hierarchy, where should this policy fit?

A CISO is preparing a business case for a new security investment. Which TWO elements are most important to include to justify the investment?

A multinational organization handles personal data of EU residents. Which regulatory requirement must the information security program address?

A policy exception management process allows a business unit to temporarily deviate from a security policy. What is the MOST important requirement for such an exception?

A CISO is presenting a security investment proposal to the board. Which two metrics are most effective for articulating the business value of the investment?

A CISO is building a business case for a new security tool. Which approach BEST articulates the return on investment (ROI) to the board?

An organization's board of directors wants to improve security culture. Which initiative would have the GREATEST impact?

An organization is implementing a policy exception management process. Which THREE elements are essential for effective exception handling? (Select THREE.)

A CISO is developing a multi-year security roadmap aligned with business strategy. The organization is in a highly regulated industry with frequent regulatory changes. Which of the following should be the PRIMARY driver for prioritizing security initiatives?

An organization is implementing a security culture measurement program. Which THREE metrics would BEST indicate a positive security culture?

A CISO is building a business case for a new security tool. Which of the following approaches is MOST effective for justifying the investment?

Which of the following is the PRIMARY role of the board of directors in information security governance?

Which of the following is the primary responsibility of the board of directors in information security governance?

An organization is deciding whether to adopt a centralized or hybrid security governance model. Which factor MOST strongly favors a hybrid model?

A multinational organization must comply with GDPR, CCPA, and PCI DSS. Which approach is MOST effective for managing these overlapping requirements?

An organization's board of directors wants to ensure that security activities align with business objectives. Which governance practice best supports this alignment?

Which of the following is the PRIMARY responsibility of the board of directors regarding information security governance?

Which of the following best describes a key benefit of a centralized information security governance model?

Which of the following is the BEST example of a board-level security metric?

Which of the following is the FIRST step in the security policy development lifecycle?

Which TWO elements are key components of a security culture measurement program?

A CISO is presenting a security metrics dashboard to the board. Which TWO metrics are most appropriate for board-level reporting? (Select TWO.)

A security metrics program should include key performance indicators (KPIs) for board reporting. Which metric is most appropriate for executive oversight?

An organization is developing an information security strategy aligned with business objectives. Which of the following is the BEST approach to prioritize security investments?

An organization is updating its security policies. After drafting the policy, which step should occur NEXT?

A security awareness programme is being evaluated. Which metric BEST indicates a positive security culture?

Which board-level metric is MOST useful for measuring the effectiveness of the incident response process?

A CISO is building a business case for a new security tool. Which TWO metrics would BEST justify the investment to senior leadership?

What is the first step in the security policy development lifecycle?

Which governance model is characterized by a single, centralized security team that serves the entire organization?

A financial services firm is subject to SOX, PCI DSS, and GDPR. The CISO needs to implement a regulatory change management process. Which THREE steps are essential?

A CISO is designing a security metrics program for the board. Which TWO metrics are MOST appropriate for board-level reporting?

Which TWO components are essential for an effective information security governance framework?

Which of the following is the FIRST step in the security policy development lifecycle?

A CISO is developing a multi-year security roadmap. Which approach best ensures the roadmap aligns with business strategy?

An organization has a decentralized governance model where each business unit manages its own security team. The CISO reports to the CIO. Which of the following is the GREATEST risk associated with this structure?

During a policy exception review, the CISO identifies that multiple exceptions have been granted for the same control due to business constraints. What is the best course of action?

Which of the following is the BEST metric for the board to assess the security program's effectiveness in detecting threats?

Which board-level committee typically receives security reports to provide oversight?

In a Capability Maturity Model (CMM) for information security processes, which level is characterized by processes being measured and controlled?

A CISO is developing a multi-year security roadmap. Which of the following should be the PRIMARY driver for prioritizing initiatives?

Which of the following best describes the role of the chief information security officer (CISO) in a governance context?

A security manager is measuring the security culture of the organization. Which three metrics are most appropriate?

The board of directors has requested a security metrics dashboard. Which metric would BEST demonstrate the effectiveness of the incident response process?

An organization is implementing a security awareness program. Which metric is MOST indicative of a positive security culture?

In which reporting model does the CISO have a direct reporting line to the CEO while also reporting to the CIO on operational matters?

A company is developing a business case for a new security tool. Which metric best demonstrates the value of the investment?

An organization is implementing a new security policy. Which step should occur AFTER the policy is approved?

An organization is designing a security metrics dashboard for the board of directors. Which THREE metrics are most appropriate for board-level reporting?

An organization has a decentralized governance model with security teams embedded in each business unit. The CISO is concerned about inconsistent security controls across the enterprise. What is the BEST recommendation to address this?

Which TWO regulations are MOST likely to impact an organization that processes credit card payments and handles personal data of EU residents?

A security policy is being developed. Which THREE steps are part of the policy development lifecycle? (Select THREE)

An organization is updating its information security strategy. Which THREE elements should be included to ensure alignment with business objectives? (Select THREE)

A CISO is developing a security strategy. Which THREE elements should be included in a multi-year security roadmap?

An organization is subject to GDPR, PCI DSS, and SOX. What is the BEST approach to manage compliance with multiple regulations?

Which capability maturity model (CMM) level is characterized by security processes being standardized and documented across the organization?

An organization is designing a policy exception management process. Which THREE elements are critical for this process to be effective?