A retail company has a limited security budget. The CISO must decide between funding a new SIEM platform or expanding the penetration testing program. Which governance approach would most effectively ensure efficient use of resources?

Fund the SIEM because it provides continuous monitoring.

Fund the penetration testing because it finds real vulnerabilities.

Split the budget equally between both initiatives.

Conduct a risk-based cost-benefit analysis and align the choice with the organization's risk appetite and business priorities.

A multinational corporation is deciding whether to enter a new market that requires storing customer data in a specific country. The security team has identified that the local data center has higher physical security risks. The board wants to proceed. What governance process should be used?

Implement compensating controls and proceed without board involvement.

Perform a formal risk assessment, present the risk to the board, and obtain an explicit risk acceptance decision.

Proceed without additional analysis because the board has already decided.

Decline the market entry because the risk is too high.

A government agency is developing its security governance documentation. Which document should be created first to establish the authority and mandate for the security program?

Vendor risk assessment questionnaire

Security awareness training material

A company is implementing a security governance program. The CEO is reluctant to allocate time for board security briefings. What is the most effective way to gain CEO support?

Explain how governance reduces business risk and supports strategic objectives, using examples relevant to the CEO's priorities.

Ask the board to mandate the CEO's participation.

Threaten to resign if the CEO does not support the program.

Implement the program without CEO involvement.

Which of the following is an example of a governance framework component?

A vulnerability scanner configuration

EC-CouncilAssociate C|CISO

Domain 1Objective 2

Defining an Information Security Governance Program ACCISO Practice Questions (Page 5)

Part of the Governance, Risk, and Compliance domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 21–25

21application · medium
A retail company has a limited security budget. The CISO must decide between funding a new SIEM platform or expanding the penetration testing program. Which governance approach would most effectively ensure efficient use of resources?
Select an answer first
22expert · hard
A multinational corporation is deciding whether to enter a new market that requires storing customer data in a specific country. The security team has identified that the local data center has higher physical security risks. The board wants to proceed. What governance process should be used?
Select an answer first
23application · medium
A government agency is developing its security governance documentation. Which document should be created first to establish the authority and mandate for the security program?
Select an answer first
24expert · hard
A company is implementing a security governance program. The CEO is reluctant to allocate time for board security briefings. What is the most effective way to gain CEO support?
Select an answer first
25foundation · easy
Which of the following is an example of a governance framework component?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.