CISSP.app Daily QuestionsFree DiagnosticPricing
Security and Risk ManagementHard

CISSP Practice Question: A financial services firm is facing increased regulatory scrutiny and must implement…

Published October 17, 2026 · Free daily CISSP practice question
A financial services firm is facing increased regulatory scrutiny and must implement a new information security program. The CISO proposes allocating budget primarily towards compliance tools, while the CIO advocates for investing in advanced threat detection systems. Given the competing priorities and regulatory environment, what should be the PRIMARY focus in this scenario?
  1. A.Implement compliance tools to meet regulatory requirements
  2. B.Invest in advanced threat detection systems
  3. C.Balance both compliance and threat detection
  4. D.Conduct a risk assessment to prioritize needs
Correct answer: D. Conduct a risk assessment to prioritize needs

Correct Answer: D. Conduct a risk assessment to prioritize needs

Explanation (CISSP Manager Logic):

A manager must base strategic resource allocation on objective data rather than competing departmental advocacy. A formal risk assessment identifies the highest business impacts, allowing the organization to balance regulatory obligations with technical security needs effectively.

By conducting a risk assessment, you:

  • Align security investments with the organization’s specific risk tolerance.
  • Provide a defensible, data-driven justification for budget allocation to stakeholders.
  • Determine whether compliance gaps or technical vulnerabilities pose the greater threat to the mission.

While the other options are relevant, they fall short because:

  • A: Focusing solely on compliance leads to "checkbox security" that may leave the firm vulnerable to actual technical breaches.
  • B: Prioritizing tools over regulations can result in legal penalties, fines, and the loss of operating licenses.
  • C: Attempting to balance both without a baseline assessment leads to inefficient resource distribution and lacks a strategic roadmap.

Think like a manager:

Effective governance requires risk-based decision-making. Always establish the "why" through assessment before committing capital to the "how" of technical or administrative controls.

Ready to find out if you'd pass?

5,000+ expert-calibrated questions, adaptive CAT mock exams, and gap analysis that shows exactly what to study next.

Try 5 free questions Start 7-day free trial
← Previous question All questions