What is the CISO's role in promoting security awareness within an organization?

To establish a culture where employees understand and value security

To focus solely on technical security controls and ignore human factors

To ensure that only the IT department receives security training

To personally deliver every security training session

A company is considering a new business partnership that requires sharing customer data with a third party. The CISO has been asked to evaluate the security implications. Which action best reflects the CISO's risk management responsibility?

Delegating the security evaluation to the procurement department

Approving the partnership immediately because the legal team has reviewed the contract

Conducting a risk assessment of the third party's security posture and data-handling practices

Refusing to share any data with third parties under any circumstances

A CISO needs to communicate a critical security risk to the board of directors. The risk is that a legacy system, which is essential to operations, cannot be patched against a known vulnerability. The CISO has proposed compensating controls, but they are expensive. The board is divided: some members want to accept the risk to save costs, while others want to invest in the compensating controls. What is the CISO's most appropriate action?

Decide unilaterally to implement the compensating controls because the risk is too high.

Present both options with a clear analysis of the costs, benefits, and residual risks, and recommend a course of action based on the organization's risk appetite.

Delay the decision until the legacy system can be replaced, even if it takes several years.

Advise the board to accept the risk because the legacy system is essential and cannot be replaced.

Why is it important for a CISO to stay current with emerging security threats and technologies?

To avoid having to update the security strategy

To be able to name the latest tools in meetings

To comply with a legal requirement to track all new technologies

To ensure the organization's security program remains effective against evolving risks

A CISO is monitoring the threat landscape and notices an increase in supply-chain attacks targeting the company's industry. The company relies on several third-party vendors. Which action best demonstrates the CISO's responsibility to stay current with emerging trends?

Reviewing the vendor risk management program to include supply-chain attack scenarios

Delegating the trend analysis to the security operations center

Ignoring the trend because the company has not been attacked yet

Terminating all third-party vendor relationships

EC-CouncilAssociate C|CISO

Domain 3Objective 1

The Role of the CISO ACCISO Practice Questions (Page 9)

Part of the Security Program Management and Operations domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

13concepts

Questions 41–45

41foundation · easy
What is the CISO's role in promoting security awareness within an organization?
Select an answer first
42application · medium
A company is considering a new business partnership that requires sharing customer data with a third party. The CISO has been asked to evaluate the security implications. Which action best reflects the CISO's risk management responsibility?
Select an answer first
43expert · hard
A CISO needs to communicate a critical security risk to the board of directors. The risk is that a legacy system, which is essential to operations, cannot be patched against a known vulnerability. The CISO has proposed compensating controls, but they are expensive. The board is divided: some members want to accept the risk to save costs, while others want to invest in the compensating controls. What is the CISO's most appropriate action?
Select an answer first
44foundation · easy
Why is it important for a CISO to stay current with emerging security threats and technologies?
Select an answer first
45application · medium
A CISO is monitoring the threat landscape and notices an increase in supply-chain attacks targeting the company's industry. The company relies on several third-party vendors. Which action best demonstrates the CISO's responsibility to stay current with emerging trends?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.