712-50 Question 46
Single answerUnderstand information security changes, trends, and best practicesA newly appointed CISO at a global manufacturing company is reviewing the security strategy after several industry incidents involving software supply chain compromise, misuse of privileged access, and delayed cloud misconfiguration detection. The board has asked for one strategic initiative that best reflects current information security trends and best practices while remaining practical across the company's hybrid environment. Which initiative should the CISO prioritize FIRST?
- A
Launch an enterprise-wide zero trust program that includes identity-centric access controls, continuous verification, stronger third-party software assurance, and prioritized visibility into cloud and on-premises assets
- B
Increase annual security awareness training frequency from once to four times per year because most modern breaches are primarily caused by employee negligence
- C
Replace all existing security technologies with a single vendor platform to reduce complexity, even if current controls are functioning adequately
- D
Delay major strategic changes until a full year of internal incident data is collected so investments can be based only on company-specific evidence
Show answer and explanation
Correct answer: A
Explanation
The best answer is the enterprise-wide zero trust initiative because it most effectively incorporates current information security changes, trends, and best practices into a practical executive strategy. Recent industry guidance has consistently emphasized identity as the new control plane, continuous validation instead of implicit trust, improved asset visibility, stronger privileged access management, and software supply chain assurance. NIST SP 800-207 provides foundational zero trust guidance, while CISA's Zero Trust Maturity Model and Secure by Design principles reinforce the importance of continuous verification, reducing attack paths, and improving resilience. In parallel, supply chain security guidance such as NIST SP 800-218 (Secure Software Development Framework) and broader software assurance practices reflect the need to address third-party software risk. A CCISO-level leader should recognize that modern best practice is not a single product purchase or awareness campaign, but a risk-aligned strategic program combining identity, visibility, access control, and supplier assurance across hybrid environments.
- A. Correct.
Correct. This option aligns with major current security trends and widely recognized best practices: zero trust principles, identity-first security, continuous authentication/authorization, asset visibility, and software supply chain risk management. It also addresses the hybrid environment pragmatically rather than proposing a narrow technical fix. Current guidance from NIST, CISA, and other authorities emphasizes reducing implicit trust, improving visibility, and strengthening supply chain security after high-profile compromises. For a CISO, prioritizing a strategic program that integrates these themes is more effective than isolated point improvements.
- B. Incorrect.
Incorrect. Security awareness is valuable, but this option overstates the role of employee negligence and does not directly address the scenario's main risk drivers: supply chain compromise, privileged access misuse, and cloud misconfiguration. A common misconception is that more training alone is a sufficient strategic response to modern threats. While training should remain part of the program, it is not the best first initiative compared with architecture and control improvements tied to current threat trends.
- C. Incorrect.
Incorrect. Platform rationalization can reduce operational complexity, but replacing all tools with a single vendor is not, by itself, a best-practice response to emerging threats. It may create concentration risk, disruption, and implementation gaps. The misconception here is that consolidation automatically improves security. Effective strategy should be driven by risk, resilience, and control objectives rather than broad vendor replacement.
- D. Incorrect.
Incorrect. Using internal data is important, but waiting a full year before acting ignores well-established external threat intelligence and industry lessons. Security leaders are expected to adapt based on changes in the threat landscape, regulatory expectations, and recognized best practices, not only retrospective internal evidence. The misconception is that action should be delayed until perfect data is available; in practice, CISOs must make risk-informed decisions using both internal and external sources.