What is the purpose of adjusting ROI for risk?

To increase the reported ROI to make the project more attractive

To eliminate all potential risks from the investment

To calculate the exact future cash flows of the project

To account for uncertainty in the estimated costs and benefits

A CISO is preparing a business case for a security awareness program. The program is expected to reduce phishing incidents, but the savings are difficult to measure precisely. Which approach best quantifies the intangible benefit of reduced reputational damage?

Assign a monetary value based on the estimated cost of a public breach scenario

Use the total cost of the awareness program as a proxy for the benefit

Exclude reputational damage from the analysis because it cannot be measured

State that reputational damage is 'high' without a monetary figure

What does the payback period measure for a security project?

The total profitability of the project over its lifetime

The discount rate at which the project breaks even

The net present value of all future cash flows

The time required to recover the initial investment

A CISO is building a business case for a multi-factor authentication (MFA) rollout. The primary benefit is reducing account takeover incidents. How should the CISO quantify this benefit?

Count the number of MFA prompts as a benefit

Use the total cost of the MFA solution as the benefit

State that account takeovers will be 'significantly reduced' without a number

Estimate the average cost per account takeover incident and multiply by the expected reduction in incidents

EC-CouncilAssociate C|CISO

Domain 5Objective 5

Return on Investment (ROI) and Cost-Benefit Analysis ACCISO Practice Questions (Page 5)

Part of the Strategic Planning, Finance, Procurement, and Vendor Management domain, which makes up ~23% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 2–3 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 21–25

21foundation · easy
What is the purpose of adjusting ROI for risk?
Select an answer first
22application · medium
A CISO is preparing a business case for a security awareness program. The program is expected to reduce phishing incidents, but the savings are difficult to measure precisely. Which approach best quantifies the intangible benefit of reduced reputational damage?
Select an answer first
23application · easy
A company is considering a new security information and event management (SIEM) system. The initial cost is $200,000, and the expected annual net benefit is $60,000. What is the payback period?
Select an answer first
24foundation · easy
What does the payback period measure for a security project?
Select an answer first
25application · medium
A CISO is building a business case for a multi-factor authentication (MFA) rollout. The primary benefit is reducing account takeover incidents. How should the CISO quantify this benefit?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.