CBS 700 Chapter 2 | Baamboozle - Baamboozle | The Most Fun Classroom Games!

0%

0 0 0

Which body is primarily responsible for security governance in an organisation?

The board and executive leadership

A CISO presents this to the board: "We applied 312 patches and updated firewall rules 47 times." What is the main governance problem

It uses technical metrics without communicating risk status, business impact, or compliance posture

In the Zachman framework applied to security, which dimension addresses "Who has access to what?"

Who (People)

Describe ONE key difference between the role of the CRO and the role of the CISO.

CRO manages enterprise-wide risk across all business functions;The CISO focuses specifically on the information security programme and strategy

Security management and security governance refer to the same level of organisational activity.

Governance (board level) sets strategy. Management (CISO/senior managers) translates strategy into plans. Operations (IT/security teams) implements controls.

According to ITU-T X.1054, security governance is best defined as:

The system by which an organisation's information security activities are directed and controlled

What model can be used to identify/classify a threat?

STRIDE

Mention any typical component of a strategic security plan?

A strategic security plan covers mission/vision, risk profile, current/target state, roadmap, and success metrics — all strategic

Which level of the security policy hierarchy contains step-by-step instructions for handling a phishing email report?

Standard operating procedure (Level 4)

What is the primary responsibility of the CISO?

Leading the security programme and owning security strategy

An Acceptable Use Policy (AUP) sits at which level of the security policy hierarchy?

Level 2 — Topic-specific policy

A CRO wants to accept a cybersecurity risk to reduce costs. The CISO disagrees. Who has ultimate authority over this decision?

The board — risk tolerance is a governance-level decision

What makes SABSA different from a purely technology-led approach to security architecture?

SABSA is risk-driven and starts from business requirements, ensuring security architecture is not a technical afterthought.

Once a security policy is approved, it does not need to be reviewed unless a major security incident occurs

Policies must be reviewed regularly as the threat landscape, regulations, business environment, and technology change

List any of the elements that a well-crafted Acceptable Use Policy should cover.

(1) permitted uses of organisational systems; (2) prohibited uses of systems; (3) internet and email usage rules; (4) data handling requirements; (5) consequenc

What is meant by Risk Appetite?

The willingness of an organization to accept risk

Security architecture is primarily about designing firewalls and technical network infrastructure.

Security architecture encompasses people, processes, and technology. It covers governance, data classification, access management, and cultural factors

Give any reason why security strategy must be aligned with business strategy rather than developed independently.

(1) Security must enable the business, 2) Resource allocation requires business context, (3) Risk tolerance is a business decision, (4) Compliance obligations