A mid-sized bank has a mature security operations team that deploys and tunes firewalls, runs vulnerability scans, and responds to incidents. However, the board has no visibility into security risk, and security projects are funded only after a breach or regulatory fine. The new CISO wants to shift from reactive security management to a governance-driven approach. Which action best represents that shift?

Establish a board-level security committee that reviews risk appetite, approves security strategy, and receives regular risk reports.

Increase the frequency of vulnerability scans and shorten the patch cycle for critical systems.

Hire additional security analysts to reduce the mean time to respond to incidents.

Deploy a new SIEM platform to correlate logs and generate more alerts for the security team.

Which of the following is an example of a governance reporting activity?

An IT technician resetting a user's password

The CISO presenting a quarterly security dashboard to the board of directors

A security analyst reviewing firewall logs

A developer writing secure code

A multinational corporation operates in multiple jurisdictions with conflicting regulatory requirements. The CISO must select a governance framework that provides a common baseline while allowing for regional adaptations. Which approach is most effective?

Let each regional office select its own framework independently.

Use a single set of policies based on the strictest regional regulation for all locations.

Adopt COBIT as the only framework and ignore regional regulations.

Adopt ISO/IEC 27001 as the global baseline and implement regional overlays to address specific legal and regulatory requirements.

Which activity is an example of information security management, rather than governance?

The CISO presenting a quarterly risk report to the executive committee

The board of directors approving the annual information security budget

A security analyst applying a critical security patch to a production server

The board establishing the organization's risk appetite statement

A multinational corporation is expanding into a region with strict data residency laws. The board wants to enter the market quickly but also wants to avoid regulatory penalties. The CISO must align security governance with this business strategy. Which approach best balances speed and compliance?

Implement a security governance process that includes a rapid compliance assessment for new regions, with predefined risk acceptance criteria.

Enter the market immediately and address compliance issues after launch.

Use a single global security policy without regional adjustments to save time.

Delay market entry until a full security program is built from scratch in the new region.

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 2

Defining an Information Security Governance Program CCISO Practice Questions (Page 1)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

Questions 1–5

1application · medium
A mid-sized bank has a mature security operations team that deploys and tunes firewalls, runs vulnerability scans, and responds to incidents. However, the board has no visibility into security risk, and security projects are funded only after a breach or regulatory fine. The new CISO wants to shift from reactive security management to a governance-driven approach. Which action best represents that shift?
Select an answer first
2foundation · easy
Which of the following is an example of a governance reporting activity?
Select an answer first
3expert · hard
A multinational corporation operates in multiple jurisdictions with conflicting regulatory requirements. The CISO must select a governance framework that provides a common baseline while allowing for regional adaptations. Which approach is most effective?
Select an answer first
4foundation · easy
Which activity is an example of information security management, rather than governance?
Select an answer first
5expert · hard
A multinational corporation is expanding into a region with strict data residency laws. The board wants to enter the market quickly but also wants to avoid regulatory penalties. The CISO must align security governance with this business strategy. Which approach best balances speed and compliance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.