I85PREP
⌘ K
CISO study materials
CISO study resources

CISO practice questions

One question at a time. Build your CISO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance, Risk and Compliance

Which document, approved by executive management, establishes the CISO's authority and the organization's overall direction for managing information security risk?

  1. The disaster recovery runbook
  2. The acceptable use procedure
  3. The business continuity plan
  4. The information security policy Correct answer.

Explanation

An information security policy is the top-level governance document that assigns authority, states management intent, and sets the framework under which lower-level standards and procedures operate. Procedures and continuity plans implement policy but do not confer the CISO's mandate.

Question 2Governance, Risk and Compliance

A CISO wants a single metric showing how much risk the organization carries after controls are applied. Which measure should be reported to the board?

  1. Residual risk exposure Correct answer.
  2. Mean time to patch
  3. Number of vulnerability scans run
  4. Control coverage percentage

Explanation

Residual risk is the risk remaining after existing controls are considered, which is the figure a board needs to decide whether to accept, treat, transfer, or avoid exposure. Operational metrics such as scan counts or patch times are inputs that inform treatment decisions but do not express remaining exposure.

Question 3Governance, Risk and Compliance

Which principle requires that a person who approves a payment cannot also be the person who records it in the ledger?

  1. Separation of duties Correct answer.
  2. Need to know
  3. Least privilege
  4. Defense in depth

Explanation

Separation of duties splits conflicting responsibilities across different people so that no single individual can both initiate and conceal a transaction. Least privilege limits what an account can do, but it does not by itself prevent one person from holding two conflicting roles.

Question 4Governance, Risk and Compliance

Under a risk assessment methodology, what does the risk score represent?

  1. The number of vulnerabilities identified in a penetration test
  2. The combination of likelihood and impact of a threat exploiting a vulnerability Correct answer.
  3. The percentage of assets covered by antivirus software
  4. The cost of the security controls currently deployed

Explanation

Risk is generally modeled as a function of the likelihood that a threat event occurs and the impact if it does, usually in the context of existing vulnerabilities. Test findings, control costs, and coverage percentages are inputs or outputs around that model, not the score itself.

Question 5Governance, Risk and Compliance

Which activity best demonstrates that a CISO has established accountability for information security across business units?

  1. The security team publishes a monthly list of open vulnerabilities
  2. Business unit leaders sign annual security responsibility statements tied to their performance objectives Correct answer.
  3. The CISO personally approves every firewall change
  4. The help desk records security incidents in a ticketing system

Explanation

Accountability is established when business owners formally accept responsibility and that responsibility is reflected in how they are measured. Centralizing approvals or publishing vulnerability lists keeps ownership with the security function rather than distributing it.

Question 6Governance, Risk and Compliance

An organization adopts an ISO/IEC 27001-based information security management system. What is the primary purpose of the internal audit clause in that standard?

  1. To measure employee security awareness scores
  2. To replace external certification audits with self-assessment
  3. To satisfy customer security questionnaires
  4. To verify that the management system conforms to requirements and is effectively implemented Correct answer.

Explanation

The internal audit requirement exists so the organization independently checks that its management system meets the standard's requirements and its own objectives, providing evidence for continual improvement. It complements external certification audits rather than substituting for them.

Question 7Governance, Risk and Compliance

A regulator issues a new rule requiring breach notification within 72 hours. What should the CISO do first in the compliance lifecycle?

  1. Update the privacy notice on the public website
  2. Schedule a penetration test of the customer portal
  3. Perform a gap assessment comparing current incident response capability against the new requirement Correct answer.
  4. Purchase cyber insurance to cover notification costs

Explanation

Compliance begins with understanding the delta between the new obligation and current practice, which a gap assessment delivers before remediation is planned. Insurance, notices, and testing may follow, but they are responses chosen after the gap is known.

Question 8Governance, Risk and Compliance

A vendor will process regulated customer data. Which artifact most directly establishes the security obligations the vendor must meet?

  1. A data processing agreement containing security and breach terms Correct answer.
  2. A verbal assurance from the vendor's account manager
  3. The vendor's marketing security brochure
  4. The vendor's public SOC 2 report summary

Explanation

Contractual terms in a data processing agreement create enforceable obligations, including security controls, breach notification, and audit rights. A SOC 2 report provides assurance evidence but does not itself bind the vendor to specific duties.

Question 9Governance, Risk and Compliance

A CISO is asked to classify information assets. Which criterion is most appropriate as the primary basis for classification?

  1. The physical location of the server hosting the data
  2. The sensitivity of the data and the harm from its unauthorized disclosure or alteration Correct answer.
  3. The department that originally requested the system
  4. The age of the application running the data

Explanation

Classification drives handling requirements, so it should reflect the value of the information and the business harm that loss of confidentiality, integrity, or availability would cause. Location, requesting department, and system age are contextual facts that do not express sensitivity.

Question 10Governance, Risk and Compliance

A risk owner decides to accept a high risk because the cost of treatment exceeds the potential loss. What governance condition must be satisfied for this acceptance to be valid?

  1. The acceptance is documented and approved at an authority level commensurate with the risk Correct answer.
  2. The security team alone signs off on the decision
  3. The risk is removed from the risk register to avoid audit findings
  4. The acceptance remains valid indefinitely without review

Explanation

Risk acceptance is a legitimate treatment option only when formally recorded and approved by someone with authority appropriate to the exposure. Removing it from the register or letting the security team decide alone undermines accountability and oversight.

Question 11Governance, Risk and Compliance

Which control type is a mandatory security awareness training program completed by all staff?

  1. Detective
  2. Compensating
  3. Preventive Correct answer.
  4. Corrective

Explanation

Awareness training is preventive because it aims to stop incidents before they occur by improving behavior. Detective controls identify events after they happen and corrective controls restore conditions afterward.

Question 12Governance, Risk and Compliance

A CISO must demonstrate compliance with a legal requirement to retain security logs for one year. Which evidence is most persuasive to an auditor?

  1. A memo stating that the security team intends to retain logs
  2. An email from a vendor promising log retention
  3. A slide from a security awareness presentation
  4. System configuration showing retention settings plus sampled log records covering the period Correct answer.

Explanation

Auditors seek evidence that the control operated, which means configuration proving the setting plus actual records showing retention in practice. Intentions, presentations, and vendor promises are assertions without operational proof.

Question 13Governance, Risk and Compliance

What distinguishes a standard from a procedure in a security governance framework?

  1. A standard applies only to IT staff, while a procedure applies to all employees
  2. A standard states mandatory requirements, while a procedure gives step-by-step instructions to meet them Correct answer.
  3. A standard is approved by auditors, while a procedure is approved by the CISO
  4. A standard is optional guidance, while a procedure is mandatory

Explanation

Standards define what must be done and are mandatory within scope, while procedures describe how tasks are performed step by step. Both sit beneath the policy and are typically approved through management processes.

Question 14Governance, Risk and Compliance

A business unit wants to launch a new customer portal in two weeks. The CISO requires a security review before go-live. What is the most appropriate governance mechanism to prevent recurring last-minute conflicts?

  1. Outsource all application security decisions to the vendor
  2. Embed security gate reviews into the organization's project lifecycle with defined entry criteria Correct answer.
  3. Waive the review to meet the launch date and assess afterward
  4. Require the CISO to personally test every release

Explanation

Integrating security gates into the standard project lifecycle makes review a predictable, planned step rather than an emergency negotiation. Waiving review or centralizing testing with the CISO creates risk and does not scale.

Question 15Governance, Risk and Compliance

Which statement best describes the concept of risk appetite?

  1. The list of threats identified during a threat modeling session
  2. The maximum budget allocated to security tooling
  3. The amount and type of risk an organization is willing to pursue or retain in pursuit of objectives Correct answer.
  4. The total number of risks recorded in the risk register

Explanation

Risk appetite expresses the level of exposure leadership is prepared to accept in pursuit of strategy, and it guides treatment decisions. Register counts, budgets, and threat lists are operational artifacts that do not define tolerance for risk.

Question 16Governance, Risk and Compliance

A CISO reports that a critical third-party processor suffered a breach affecting customer data. Under most privacy regimes, which obligation arises first for the controller?

  1. Notify the regulator and affected individuals within the timeframe set by applicable law Correct answer.
  2. Publish the incident on social media to demonstrate transparency
  3. Terminate the vendor contract before assessing the scope
  4. Wait until the processor completes its own investigation before any notification

Explanation

Controllers generally carry the legal duty to notify regulators and data subjects within prescribed deadlines once a reportable breach is known. Waiting for the processor's full investigation can cause the deadline to be missed.

Question 17Governance, Risk and Compliance

An organization uses a maturity model to assess its security program. What does a maturity level primarily indicate?

  1. The percentage of staff who passed a phishing simulation
  2. The count of open audit findings
  3. The degree to which processes are defined, managed, measured, and continuously improved Correct answer.
  4. The number of security tools deployed per employee

Explanation

Maturity models assess how institutionalized and repeatable processes are, progressing from ad hoc to defined, measured, and optimized. Tool counts, simulation results, and finding counts are point metrics rather than indicators of process maturity.

Question 18Governance, Risk and Compliance

A CISO is evaluating whether to build or buy a security capability. Which governance consideration most directly affects the decision?

  1. The vendor's headquarters location
  2. The number of features listed on the vendor's website
  3. The organization's ability to retain accountability and oversight for the outsourced function Correct answer.
  4. The age of the vendor's marketing materials

Explanation

Outsourcing execution does not outsource accountability, so the CISO must confirm that oversight, reporting, and control remain with the organization. Vendor location and feature lists are secondary factors in that governance judgment.

Question 19Governance, Risk and Compliance

Which arrangement best satisfies the principle that risk decisions should be made at the appropriate level of the organization?

  1. A risk committee with business, legal, and security representation reviews risks above a defined threshold Correct answer.
  2. The security operations team decides all risk treatments independently
  3. Individual developers accept risks for the systems they build
  4. The procurement team approves risk acceptance for vendor systems

Explanation

Escalating risks above a defined threshold to a cross-functional committee ensures decisions reflect business context and appropriate authority. Leaving acceptance to technical teams or procurement concentrates decisions where business accountability is absent.

Question 20Governance, Risk and Compliance

A CISO discovers that a subsidiary in another country applies local security rules that conflict with the parent company's global policy. What is the most defensible governance approach?

  1. Document the conflict, determine the stricter applicable requirement, and record an approved exception where needed Correct answer.
  2. Apply the global policy unchanged and ignore local law
  3. Suspend operations in that country until the laws change
  4. Let the subsidiary set its own policy without oversight

Explanation

Global programs must reconcile local legal obligations with corporate standards, typically by applying the more stringent requirement and managing genuine conflicts through a documented exception process. Ignoring local law or abandoning oversight creates legal and governance exposure.

Question 21Governance, Risk and Compliance

What is the primary governance value of maintaining a risk register with named owners and treatment plans?

  1. It replaces the need for management review meetings
  2. It guarantees that no security incidents will occur
  3. It satisfies all regulatory requirements automatically
  4. It provides a traceable record linking identified risks to accountable owners and remediation decisions Correct answer.

Explanation

A well-maintained register creates traceability from each risk to its owner, treatment decision, and status, which supports oversight and audit. It is a management tool, not a guarantee of outcomes or a substitute for review.

Question 22Governance, Risk and Compliance

A CISO wants to measure whether security controls are operating as designed over time. Which approach is most appropriate?

  1. A review of the security budget trend
  2. An annual employee satisfaction survey
  3. A one-time assessment performed at program inception
  4. Continuous control monitoring with defined thresholds and alerting Correct answer.

Explanation

Continuous monitoring detects control drift and failures between periodic audits by comparing actual operation against defined thresholds. A one-time assessment becomes stale, and surveys or budget trends do not test control operation.

Question 23Governance, Risk and Compliance

Which document typically records management's formal acceptance of residual risk after remediation is complete?

  1. The change management log
  2. The incident response plan
  3. A risk acceptance record signed by the accountable risk owner Correct answer.
  4. The asset inventory

Explanation

A signed risk acceptance record documents that the accountable owner reviewed the remaining exposure and chose to accept it, providing an audit trail. The other documents support operations but do not record acceptance decisions.

Question 24Governance, Risk and Compliance

An auditor finds that a policy requires quarterly access reviews but reviews occurred only twice in the past year. Which governance failure does this most directly illustrate?

  1. A gap in the disaster recovery plan
  2. A deficiency in monitoring compliance with the organization's own policy Correct answer.
  3. A failure of the risk appetite statement
  4. An absence of an information security policy

Explanation

The policy exists but the organization did not verify that practice matched it, which is a compliance monitoring deficiency. The finding does not indicate a missing policy, a flawed appetite statement, or a recovery planning gap.

Question 25Governance, Risk and Compliance

A CISO needs board support for a new security investment. Which framing is most effective for a governance audience?

  1. Quantified risk reduction and business impact compared with the cost of the investment Correct answer.
  2. A comparison of competing security products' feature sets
  3. An explanation of encryption algorithms in use
  4. A detailed list of technical vulnerabilities found in the last scan

Explanation

Boards decide on business terms, so linking the investment to reduced exposure and business impact against cost supports a risk-based decision. Technical vulnerability lists and product comparisons lack the business context executives need.

Question 26Governance, Risk and Compliance

A CISO is drafting the top-level document that states management's commitment to protect information and sets mandatory principles across the whole enterprise. Which governance artifact is being produced?

  1. A baseline configuration standard
  2. A disaster recovery runbook
  3. A vulnerability scan report
  4. An information security policy Correct answer.

Explanation

The information security policy is the highest-level internal document; it expresses management intent and mandatory principles that all lower-level standards and procedures must support. Standards, runbooks, and scan reports operate at more tactical or technical levels and cannot by themselves establish enterprise-wide intent.

Question 27Governance, Risk and Compliance

A CISO maps security activities to the three lines model. Which group constitutes the second line in a typical financial-services structure?

  1. The internal audit function reporting to the board
  2. The IT operations team that configures and runs security controls
  3. The risk and compliance function that sets frameworks and monitors the first line Correct answer.
  4. The external auditor engaged for the annual certification

Explanation

In the three lines model the first line owns and operates controls, the second line provides independent oversight, frameworks, and monitoring, and the third line is internal audit. The risk and compliance function is the classic second line because it guides and challenges without owning operational controls.

Question 28Governance, Risk and Compliance

Under the GDPR, which role determines the purposes and means of processing personal data?

  1. The processor
  2. The supervisory authority
  3. The data subject
  4. The controller Correct answer.

Explanation

The controller decides why and how personal data is processed and carries the primary accountability for lawful processing. Processors act on the controller's documented instructions, supervisory authorities regulate, and data subjects are the individuals whose data is processed.

Question 29Governance, Risk and Compliance

A CISO wants a single consistent method for scoring risks so that business units can compare and prioritize findings. Which element of the risk management framework provides this?

  1. A list of all approved software vendors
  2. A defined risk assessment methodology with calibrated likelihood and impact scales Correct answer.
  3. An incident response communication plan
  4. A schedule of penetration tests

Explanation

Consistent comparability comes from a documented risk assessment methodology that defines scales, criteria, and calculation so different assessors produce comparable results. Communication plans, vendor lists, and test schedules are operational artifacts that do not standardize risk scoring.

Question 30Governance, Risk and Compliance

Which statement best captures the distinction between a security standard and a security procedure?

  1. A standard states mandatory requirements, while a procedure gives step-by-step instructions to meet them Correct answer.
  2. A standard is optional guidance, while a procedure is legally binding
  3. A standard is reviewed annually, while a procedure is never reviewed
  4. A standard applies only to IT staff, while a procedure applies to the whole company

Explanation

Standards define what must be done and are mandatory within scope, whereas procedures describe the sequence of actions that achieves the requirement. The other options misstate optionality, audience, or review obligations, which are not the defining difference.

Question 31Governance, Risk and Compliance

A CISO needs a metric that shows whether patching is keeping pace with exposure over time. Which measure is most appropriate?

  1. Number of security awareness emails sent
  2. Median days from patch release to production deployment, tracked monthly Correct answer.
  3. Count of firewalls deployed in the estate
  4. Total number of vulnerabilities ever recorded

Explanation

A useful governance metric is time-bound and trendable; median remediation time directly reflects how quickly exposure is closed and can be tracked month over month. Raw cumulative counts and activity volumes do not indicate whether risk is actually being reduced.

Question 32Governance, Risk and Compliance

A CISO is told that a business process must continue operating even if the primary data center is unavailable. Which analysis determines how long that process can tolerate disruption?

  1. A penetration test of the data center perimeter
  2. A physical security walkthrough of the facility
  3. Business impact analysis establishing the maximum tolerable downtime Correct answer.
  4. A source code review of the primary application

Explanation

The business impact analysis identifies critical processes and derives recovery objectives such as maximum tolerable downtime and recovery time objectives. Technical tests and reviews inform controls but do not define how long the business can survive an outage.

Question 33Governance, Risk and Compliance

Which term describes the amount of risk an organization is willing to retain in pursuit of its objectives?

  1. Risk transfer
  2. Risk register
  3. Residual risk
  4. Risk tolerance Correct answer.

Explanation

Risk tolerance expresses the acceptable variation or amount of risk the organization will bear while pursuing objectives, and it operationalizes risk appetite at a practical level. A register is a record, transfer is a treatment option, and residual risk is what remains after treatment.

Question 34Governance, Risk and Compliance

A new regulation requires the CISO to prove that access to a financial system is reviewed by someone other than the person granting it. Which control design satisfies this requirement?

  1. Annual penetration testing of the financial application
  2. Encryption of the access database at rest
  3. Segregation of duties between access grantors and access reviewers Correct answer.
  4. Single sign-on with multifactor authentication for all users

Explanation

The requirement is about independence in the review process, which is achieved by separating the granting role from the reviewing role. Authentication strength, testing, and encryption improve security but do not create reviewer independence.

Question 35Governance, Risk and Compliance

A CISO is building the risk register and wants each entry to be actionable. Which set of fields best supports that goal?

  1. Risk description, vendor contact, contract value, renewal date
  2. Risk description, discovery tool, scanner version, IP address
  3. Risk description, affected department headcount, office location
  4. Risk description, owner, inherent and residual rating, treatment plan, target date Correct answer.

Explanation

An actionable register entry pairs the risk with accountability, quantified exposure before and after controls, a planned response, and a deadline so progress can be governed. Tool metadata, organizational trivia, and commercial details do not drive treatment decisions.

Question 36Governance, Risk and Compliance

A subsidiary's local law prohibits sending certain logs outside the country, but the parent's SIEM requires central collection. What is the most appropriate governance response?

  1. Send the logs anyway and document the decision after the fact
  2. Perform a legal and risk assessment and design a compliant local collection or aggregation approach Correct answer.
  3. Ignore the local law because the parent policy takes precedence
  4. Stop all logging in the subsidiary to avoid the conflict

Explanation

Conflicting legal and policy obligations are resolved through documented legal analysis and a control design that satisfies the stricter constraint, such as local aggregation with sanitized forwarding. Unilateral override, cessation of logging, or after-the-fact documentation all create legal or security exposure.

Question 37Governance, Risk and Compliance

A CISO is selecting a framework to certify an information security management system against an internationally recognized standard. Which standard is designed for that purpose?

  1. ISO/IEC 27002
  2. PCI DSS
  3. ISO/IEC 27001 Correct answer.
  4. NIST Cybersecurity Framework

Explanation

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS and is the certifiable management-system standard. ISO/IEC 27002 provides implementation guidance, the NIST CSF is a voluntary framework, and PCI DSS is a payment-card industry standard.

Question 38Governance, Risk and Compliance

A CISO must decide how to treat a risk involving a legacy system that cannot be patched and supports a revenue-critical process. Which treatment option keeps the process running while formally acknowledging the exposure?

  1. Avoid the risk by disconnecting the system from all networks
  2. Transfer the entire risk to the software vendor by contract
  3. Accept the risk with documented compensating controls and management sign-off Correct answer.
  4. Terminate the business process immediately

Explanation

Acceptance with compensating controls preserves the business function while making the residual exposure explicit and owned at the right level. Termination and disconnection would disrupt a critical process, and a vendor cannot absorb the organization's operational and regulatory accountability.

Question 39Governance, Risk and Compliance

An organization must show regulators that it maintains an up-to-date inventory of personal data processing activities. Which artifact most directly satisfies this obligation?

  1. A record of processing activities Correct answer.
  2. A business continuity plan
  3. A network topology diagram
  4. A security awareness curriculum

Explanation

Privacy laws such as the GDPR require a record of processing activities describing purposes, categories of data and subjects, recipients, and retention. Topology diagrams, continuity plans, and training curricula serve other governance purposes and do not document processing.

Question 40Governance, Risk and Compliance

A CISO is defining the escalation path for risk decisions. Which design best reflects subsidiarity while preserving accountability?

  1. All risk decisions are centralized in the CISO's office
  2. Each employee decides independently without thresholds
  3. Business owners decide within defined thresholds, with escalation to executive risk committee above them Correct answer.
  4. External auditors decide which risks the company accepts

Explanation

Good risk governance delegates decisions to the level closest to the business while defining thresholds that trigger escalation to a higher authority. Centralizing everything, removing thresholds, or outsourcing decisions to auditors undermines ownership and accountability.

Question 41Governance, Risk and Compliance

A CISO is preparing a control self-assessment program. Which characteristic most determines whether the results are trustworthy for governance reporting?

  1. Independence and evidence sampling applied to the self-reported answers Correct answer.
  2. The number of questions included in the assessment
  3. The software platform used to distribute the survey
  4. The seniority of the person who designed the questionnaire

Explanation

Self-reported control status is only credible when subject to independent validation and evidence sampling that can detect inaccurate answers. Questionnaire length, author seniority, and tooling do not by themselves establish reliability.

Question 42Governance, Risk and Compliance

A CISO must decide whether to report a security incident to a regulator. Which factor is most directly determinative under most breach notification regimes?

  1. Whether the affected system was hosted on premises or in the cloud
  2. Whether the attacker used ransomware or another technique
  3. Whether the incident creates a risk of harm to affected individuals' rights and freedoms Correct answer.
  4. Whether the incident was detected by internal or external staff

Explanation

Most notification regimes are triggered by the likelihood or risk of harm to individuals, not by attack technique or infrastructure details. Detection source and hosting model are operational facts that may inform the assessment but do not set the legal trigger.

Question 43Governance, Risk and Compliance

A CISO wants to ensure that exceptions to security policy are governed rather than ad hoc. Which mechanism is most appropriate?

  1. Automatic approval when the requester is senior
  2. Permanent waivers granted at project kickoff
  3. A formal exception process with risk assessment, time limits, and approval authority Correct answer.
  4. Verbal approval from any manager

Explanation

Policy exceptions should be risk-assessed, time-bound, and approved by an authority commensurate with the exposure so that residual risk is consciously owned. Verbal approvals, permanent waivers, and seniority-based auto-approval remove the governance controls that make exceptions safe.

Question 44Governance, Risk and Compliance

A CISO is aligning security investment with enterprise strategy. Which approach best demonstrates that security governance supports business objectives?

  1. Map security program outcomes to the enterprise risk profile and strategic goals Correct answer.
  2. Report only the number of blocked attacks each quarter
  3. Adopt every control in a framework to maximize coverage
  4. Benchmark spending against peer organizations without context

Explanation

Governance adds value when security outcomes are explicitly linked to the organization's risk profile and strategic objectives, showing how investment protects value creation. Isolated technical counts, context-free benchmarking, and indiscriminate control adoption do not demonstrate strategic alignment.

Question 45Governance, Risk and Compliance

A CISO is negotiating a contract with a cloud provider that will host regulated data. Which clause most directly preserves the organization's ability to meet its own compliance obligations?

  1. An unlimited liability cap in the provider's favor
  2. A discount schedule for volume growth
  3. A right to audit and to receive independent assurance reports on a defined schedule Correct answer.
  4. A clause allowing the provider to change subcontractors without notice

Explanation

Audit rights and periodic independent assurance reports let the organization verify that the provider's controls continue to meet regulatory expectations. Pricing, unannounced subcontracting changes, and one-sided liability terms do not support compliance evidence and may increase risk.

Question 46Governance, Risk and Compliance

A CISO must decide whether a proposed analytics initiative involving customer data is permissible. Which governance step should occur before the initiative is approved?

  1. A review of the vendor's marketing materials
  2. An inventory count of the organization's laptops
  3. A privacy impact assessment evaluating purpose, necessity, and safeguards Correct answer.
  4. A penetration test of the analytics platform

Explanation

Initiatives that introduce new processing of personal data should be preceded by an assessment of purpose, necessity, proportionality, and safeguards, often required by privacy law. Technical testing, marketing review, and asset counts do not evaluate whether the processing itself is justified and lawful.

Question 47Governance, Risk and Compliance

A CISO's board asks how the organization would know if a key control failed silently. Which governance capability most directly answers that question?

  1. A one-time external certification obtained three years ago
  2. A quarterly review of the marketing budget
  3. Continuous control monitoring with defined alert thresholds and ownership Correct answer.
  4. An annual employee satisfaction survey

Explanation

Silent control failure is detected through continuous monitoring with thresholds and named owners who respond to alerts. Point-in-time certifications and unrelated reviews provide no ongoing signal about control operation.

Question 48Governance, Risk and Compliance

A CISO finds that a critical business unit has been accepting risks without recording them. Which governance deficiency is most directly implicated?

  1. Excessive network segmentation
  2. Inadequate risk ownership and accountability structures Correct answer.
  3. Overly frequent vulnerability scanning
  4. Insufficient encryption key length

Explanation

Unrecorded risk acceptance indicates that ownership, documentation, and escalation responsibilities are not operating, which is a core governance failure. Technical configuration issues such as segmentation, key length, or scan frequency are unrelated to whether risk decisions are captured and owned.

Question 49Governance, Risk and Compliance

A regulator asks the CISO to demonstrate that security requirements flow into supplier contracts and are verified after award. Which evidence set best demonstrates this end-to-end control?

  1. The procurement team's organizational chart
  2. Contract security clauses, due diligence records, and post-contract assurance reports Correct answer.
  3. A list of all suppliers sorted by spend
  4. A copy of the corporate travel policy

Explanation

Demonstrating the full lifecycle requires evidence that requirements were defined in contracts, assessed before award, and verified through ongoing assurance. Spend lists, org charts, and unrelated policies do not show that obligations were imposed and checked.

Question 50Governance, Risk and Compliance

A CISO is asked to justify why a risk was treated with a detective control rather than a preventive one. Which reasoning is most defensible at a governance level?

  1. The preventive option was not feasible for a legacy platform, so detection with rapid response reduced exposure to an accepted level Correct answer.
  2. The auditor preferred detective controls
  3. Preventive controls are obsolete in modern architectures
  4. Detective controls are always cheaper, so cost alone determined the choice

Explanation

Control selection should reflect feasibility, cost, and the resulting residual risk against tolerance, with the rationale documented and accepted by the risk owner. Choosing on cost alone, asserting obsolescence, or deferring to preference without analysis does not constitute defensible governance reasoning.