A manufacturing company is establishing an information security governance program. The CISO has drafted a charter, defined roles and responsibilities, and created a security steering committee. What additional component is essential to complete the governance framework?

A detailed network architecture diagram

A set of policies, standards, and procedures that operationalize the governance decisions

A list of all security incidents from the past year

A vendor list of all security software suppliers

A regional bank is launching a new mobile payments product. The CISO has been asked to ensure the security program supports this strategic initiative. The CISO establishes a steering committee with business unit leaders and defines security requirements that align with the product launch timeline. Which activity best exemplifies information security governance rather than management?

Updating the incident response playbook to include the new mobile payment channel

Monitoring daily firewall logs for anomalies related to the mobile payment traffic

Directing that security investments and priorities be set to enable the mobile payments product while managing risk

Configuring the mobile app's encryption settings to meet the bank's security standards

A mid-sized company is building its security governance framework. Which component is most important to ensure that governance decisions are implemented effectively?

A calendar of security awareness events.

A clear delegation of authority and accountability for security decisions.

A comprehensive list of security tools and vendors.

A detailed security architecture diagram.

A non-profit organization has a very limited security budget. The CISO must allocate resources across three initiatives: patching critical vulnerabilities, implementing multi-factor authentication (MFA) for remote access, and developing a security awareness program. The organization has a high rate of phishing attacks and remote workers. Which allocation best reflects governance principles of resource management and value delivery?

Invest in the most expensive solution available

Prioritize MFA and awareness training because they address the highest current risks (remote access and phishing)

Focus solely on patching because it is the most technical control

Allocate equal budget to all three initiatives

How does information security governance integrate risk management into decision-making?

By requiring that risk considerations be part of strategic and operational decisions

By focusing only on compliance risks

By eliminating the need for risk assessments

By delegating all risk decisions to the IT department

EC-CouncilAssociate C|CISO

Domain 1Objective 2

Defining an Information Security Governance Program ACCISO Practice Questions (Page 8)

Part of the Governance, Risk, and Compliance domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

Questions 36–40

36application · medium
A manufacturing company is establishing an information security governance program. The CISO has drafted a charter, defined roles and responsibilities, and created a security steering committee. What additional component is essential to complete the governance framework?
Select an answer first
37application · medium
A regional bank is launching a new mobile payments product. The CISO has been asked to ensure the security program supports this strategic initiative. The CISO establishes a steering committee with business unit leaders and defines security requirements that align with the product launch timeline. Which activity best exemplifies information security governance rather than management?
Select an answer first
38application · medium
A mid-sized company is building its security governance framework. Which component is most important to ensure that governance decisions are implemented effectively?
Select an answer first
39expert · hard
A non-profit organization has a very limited security budget. The CISO must allocate resources across three initiatives: patching critical vulnerabilities, implementing multi-factor authentication (MFA) for remote access, and developing a security awareness program. The organization has a high rate of phishing attacks and remote workers. Which allocation best reflects governance principles of resource management and value delivery?
Select an answer first
40foundation · easy
How does information security governance integrate risk management into decision-making?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Defining an Information Security Governance Program ACCISO Practice Questions (Page 8)

Questions 36–40

A manufacturing company is establishing an information security governance program. The CISO has drafted a charter, defined roles and responsibilities, and created a security steering committee. What additional component is essential to complete the governance framework?

A mid-sized company is building its security governance framework. Which component is most important to ensure that governance decisions are implemented effectively?

How does information security governance integrate risk management into decision-making?

Keep studying — Governance, Risk, and Compliance