Which of the following represents the HIGHEST negative impact resulting from an ineffective security governance program?

Question

Options

• AReduction of budget
• BDecreased security awareness
• CImproper use of information resources
• DFines for regulatory non-compliance

• A
  7% (3)
• B
  13% (6)
• C
  2% (1)
• D
  78% (35)

Explanation

Regulatory fines represent the highest negative impact because they are externally imposed, quantifiably large, legally binding, and can threaten an organization's viability - unlike internal operational issues that management retains some control over. Non-compliance penalties (GDPR, HIPAA, PCI-DSS, etc.) can reach hundreds of millions of dollars and carry reputational damage that compounds the financial loss.

Why the distractors fall short:

• A (Budget reduction) is a consequence of poor prioritization, but it's an internal administrative outcome, not an external penalty with legal force.
• B (Decreased security awareness) is a symptom or contributing factor within the program, not a direct business impact - it creates risk rather than realizing harm.
• C (Improper use of information resources) is a control failure and a risk, but its actual impact is uncertain and context-dependent; a fine is certain and quantified.

Memory tip: Think "outside-in" - exam questions about highest impact almost always favor consequences imposed by external authorities (regulators, courts) over internal operational degradations. If one answer involves a regulator, fine, or legal penalty, it typically wins the "highest impact" framing.

No community discussion yet for this question.