CompTIA SecurityX (CAS-005) - 340 Questions

1. A CISO at a multinational financial services company is redesigning the security governance framework. The board has requested a model that clearly separates governance objectives from management activities, aligns IT goals with enterprise goals, and provides a set of enablers that can be measured. Which framework best satisfies these requirements?

2. A security architect is building a policy hierarchy for a large healthcare organization. The board has approved a high-level mandate that PHI must be protected in accordance with applicable regulations. The architect needs to define the relationship between the top-level document and the lower-level documents that specify how to configure encryption on endpoint devices. Which document order correctly represents the policy hierarchy from most authoritative to most prescriptive?

3. A CISO is implementing NIST CSF 2.0 across a critical infrastructure organization. The organization has strong detection and response capabilities but has never formally established risk governance processes, security roles and responsibilities, or a supply chain risk management program. According to NIST CSF 2.0, which function should the CISO prioritize to address these gaps?

4. A security program manager needs to present security performance to the board of directors. The board wants to understand both the organization's current security posture and early warning indicators of emerging risks. Which combination of metrics best satisfies the board's requirements?

5. A CISO at a financial institution is standing up a new security operations function. The organization wants to clearly define which teams make decisions, which teams are consulted before decisions, which teams must be informed of decisions, and which team owns the actual execution. Which tool should the CISO use to document these relationships?