A CISO must present a security investment proposal to the board. The board is primarily concerned with shareholder value and asks for a clear financial justification. Which presentation approach is most effective?

Present a detailed technical architecture diagram

Show the ROI, NPV, and payback period alongside a qualitative risk reduction narrative

List all security controls that will be implemented

Emphasize the technical sophistication of the solution

When presenting ROI results to senior executives, what is the most effective approach?

Focus on technical details of the security controls

Present a single ROI percentage without context

Provide only the cost-benefit analysis spreadsheet

Relate the ROI to business objectives and risk reduction

A security manager needs to present the ROI analysis of a proposed security project to the board of directors. The board is primarily concerned with long-term financial impact and risk. Which of the following approaches would be most effective in communicating the value of the investment?

Present the total cost of the project without discussing benefits

Present a range of ROI scenarios, including NPV and payback period, with clear assumptions

Focus only on the single-point ROI percentage

Emphasize only the intangible benefits without financial metrics

A CISO is presenting two security projects to the investment committee. Project A has an IRR of 15% and a payback period of 2 years. Project B has an IRR of 12% and a payback period of 4 years. The company's cost of capital is 10%. Which project should the CISO recommend?

Project B because it has a longer payback period

Project A because it has a higher IRR and shorter payback period

Neither project because both have IRRs above the cost of capital

The project with the higher NPV, which may not be Project A

EC-CouncilAssociate C|CISO

Domain 5Objective 5

Return on Investment (ROI) and Cost-Benefit Analysis ACCISO Practice Questions (Page 3)

Part of the Strategic Planning, Finance, Procurement, and Vendor Management domain, which makes up ~23% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 2–3 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 11–15

11expert · medium
A multinational corporation is evaluating a security awareness training program. The estimated annual benefit is $500,000 based on reduced phishing incidents, but the security team is uncertain about the actual reduction rate. They decide to apply a risk adjustment factor. If the base ROI is 150% and the risk adjustment factor is 0.8, what is the risk-adjusted ROI?
Select an answer first
12application · medium
A CISO must present a security investment proposal to the board. The board is primarily concerned with shareholder value and asks for a clear financial justification. Which presentation approach is most effective?
Select an answer first
13foundation · easy
When presenting ROI results to senior executives, what is the most effective approach?
Select an answer first
14application · medium
A security manager needs to present the ROI analysis of a proposed security project to the board of directors. The board is primarily concerned with long-term financial impact and risk. Which of the following approaches would be most effective in communicating the value of the investment?
Select an answer first
15expert · hard
A CISO is presenting two security projects to the investment committee. Project A has an IRR of 15% and a payback period of 2 years. Project B has an IRR of 12% and a payback period of 4 years. The company's cost of capital is 10%. Which project should the CISO recommend?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.