A company is evaluating two mutually exclusive security projects. Project A has a higher NPV but a lower IRR than Project B. The company's cost of capital is 8%. Which project should be selected?

Neither project, because the conflict indicates the analysis is flawed

Project A, because NPV is the preferred method when projects are mutually exclusive

Either project, because NPV and IRR will always lead to the same decision

Project B, because a higher IRR always indicates a better investment

Why is Net Present Value (NPV) used in evaluating long-term security investments?

It determines the internal rate of return

It accounts for the time value of money by discounting future cash flows

It measures the payback period of the investment

It calculates the total undiscounted benefits over the project's life

A CISO is presenting a multi-year security program to the CFO. The CFO is skeptical about benefits that will occur in later years. Which presentation technique best addresses this concern?

List all benefits without monetary values

Use the payback period as the sole metric

Show the NPV and explain how future benefits are discounted

Present only the first-year benefits

A CISO is presenting a security investment with a high expected ROI but also high uncertainty. The board is risk-averse and asks for a more conservative estimate. Which approach should the CISO take?

Exclude intangible benefits to simplify the analysis

Use a lower discount rate to increase the NPV

Present a range of ROIs based on best-case, base-case, and worst-case scenarios

Present the base-case ROI as the primary figure

What is a key element to include when presenting a cost-benefit analysis to stakeholders?

The names of the security vendors being considered

Assumptions and sensitivity analysis

A list of all potential threats without financial impact

EC-CouncilAssociate C|CISO

Domain 5Objective 5

Return on Investment (ROI) and Cost-Benefit Analysis ACCISO Practice Questions (Page 8)

Part of the Strategic Planning, Finance, Procurement, and Vendor Management domain, which makes up ~23% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 2–3 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 36–40

36expert · hard
A company is evaluating two mutually exclusive security projects. Project A has a higher NPV but a lower IRR than Project B. The company's cost of capital is 8%. Which project should be selected?
Select an answer first
37foundation · easy
Why is Net Present Value (NPV) used in evaluating long-term security investments?
Select an answer first
38application · medium
A CISO is presenting a multi-year security program to the CFO. The CFO is skeptical about benefits that will occur in later years. Which presentation technique best addresses this concern?
Select an answer first
39expert · hard
A CISO is presenting a security investment with a high expected ROI but also high uncertainty. The board is risk-averse and asks for a more conservative estimate. Which approach should the CISO take?
Select an answer first
40foundation · easy
What is a key element to include when presenting a cost-benefit analysis to stakeholders?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.