CAS-002 · Question #578
A security analyst at Company A has been trying to convince the Information Security Officer (ISO) to allocate budget towards the purchase of a new intrusion prevention system (IPS) capable of…
The correct answer is A. Emerging threat reports B. Company attack tends. To justify a security budget request, the analyst must present data demonstrating both external threats and internal exposure. Emerging threat reports and company attack trends together build a compelling, evidence-based case for the ISO.
Question
A security analyst at Company A has been trying to convince the Information Security Officer (ISO) to allocate budget towards the purchase of a new intrusion prevention system (IPS) capable of analyzing encrypted web transactions. Which of the following should the analyst provide to the ISO to support the request? (Select TWO).
Options
- AEmerging threat reports
- BCompany attack tends
- CRequest for Quote (RFQ)
- DBest practices
- ENew technologies report
How the community answered
(36 responses)- A81% (29)
- C6% (2)
- D3% (1)
- E11% (4)
Why each option
To justify a security budget request, the analyst must present data demonstrating both external threats and internal exposure. Emerging threat reports and company attack trends together build a compelling, evidence-based case for the ISO.
Emerging threat reports document the current and evolving threat landscape, showing the ISO that encrypted web-based attacks are a real and growing risk that justifies the IPS investment.
Company attack trends provide internal data showing that the organization has already been targeted or affected, making the IPS purchase directly relevant and defensible against actual observed incidents.
A Request for Quote is a procurement document used after a purchase decision has been made, not a tool for justifying why that purchase is necessary in the first place.
Best practices are general industry guidance and do not demonstrate organization-specific risk or provide a financial justification for a particular security investment.
A new technologies report describes available products but does not establish a threat-based or business case for why the organization specifically needs to purchase one.
Concept tested: Security budget justification using threat intelligence data
Source: https://www.cisa.gov/resources-tools/resources/cyber-threat-intelligence
Topics
Community Discussion
No community discussion yet for this question.