I was interviewing a CISO for a prior job. We asked how they would expand our team, given what we have and what we do. The candidate said that a typical team needs X, Y, and Z, but they really couldn't make an informed decision like that without being in the environment for at least a few months and seeing the way that things actually work.

My peers and I, who would report directly to the CISO, loved the answer. One of the CISO's potential peers on the interview panel thought that the candidate bombed the question, because "shouldn't they just know what's needed?"