A regional bank is launching a new mobile payments product. The CISO wants to ensure the security program supports this business initiative. Which governance action best achieves strategic alignment?

Update the information security policy to require multi-factor authentication for all mobile transactions.

Implement a new endpoint detection and response tool to protect the mobile payment servers.

Conduct a security risk assessment of the mobile payments platform and present the findings to the board for a risk acceptance decision.

Hire additional security analysts to monitor the new mobile payment platform.

A newly appointed CISO at a mid-sized company is explaining to the board why information security governance is important. Which statement best describes the purpose of information security governance?

To purchase the latest security technology available

To satisfy all regulatory requirements without exception

To ensure that security activities are aligned with business objectives and that risks are managed at an acceptable level

To guarantee that no security incident ever occurs

A logistics company is considering two security investments: a new access control system for warehouses and a security operations center (SOC) for 24/7 monitoring. The budget allows only one. The company's main risk is theft of goods, not cyber attacks. Which investment is more aligned with value delivery?

The access control system, because it directly mitigates the identified primary risk of theft.

Neither, because security investments do not generate revenue.

Both, by reallocating funds from other departments.

The SOC, because it provides continuous monitoring and rapid incident response.

A pharmaceutical company is deciding whether to acquire a smaller biotech firm with a history of data breaches. The acquisition is strategically important. How should the security governance function advise the board?

Proceed with the acquisition and address security issues after closing.

Conduct a security due diligence assessment and present the risks and mitigation options to the board for a decision.

Recommend against the acquisition due to the breach history.

Require the biotech firm to fix all breaches before the acquisition.

EC-CouncilAssociate C|CISO

Domain 1Objective 2

Defining an Information Security Governance Program ACCISO Practice Questions (Page 11)

Part of the Governance, Risk, and Compliance domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 51–55

51application · medium
A regional bank is launching a new mobile payments product. The CISO wants to ensure the security program supports this business initiative. Which governance action best achieves strategic alignment?
Select an answer first
52application · medium
A newly appointed CISO at a mid-sized company is explaining to the board why information security governance is important. Which statement best describes the purpose of information security governance?
Select an answer first
53expert · hard
A logistics company is considering two security investments: a new access control system for warehouses and a security operations center (SOC) for 24/7 monitoring. The budget allows only one. The company's main risk is theft of goods, not cyber attacks. Which investment is more aligned with value delivery?
Select an answer first
54expert · hard
A pharmaceutical company is deciding whether to acquire a smaller biotech firm with a history of data breaches. The acquisition is strategically important. How should the security governance function advise the board?
Select an answer first
55foundation · easy
Which of the following is one of the five key outcomes of information security governance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Defining an Information Security Governance Program ACCISO Practice Questions (Page 11)

Questions 51–55

A regional bank is launching a new mobile payments product. The CISO wants to ensure the security program supports this business initiative. Which governance action best achieves strategic alignment?

A newly appointed CISO at a mid-sized company is explaining to the board why information security governance is important. Which statement best describes the purpose of information security governance?

A pharmaceutical company is deciding whether to acquire a smaller biotech firm with a history of data breaches. The acquisition is strategically important. How should the security governance function advise the board?

Which of the following is one of the five key outcomes of information security governance?

Keep studying — Governance, Risk, and Compliance