A global manufacturer is launching a new cloud-based product line. The CISO has prepared a risk assessment and a proposed security architecture. According to the principles of security governance, which action should the board take?

Draft the security policies for the new product line.

Conduct penetration testing of the new product before launch.

Review and approve the technical design of the cloud network and encryption algorithms.

Approve the security architecture and risk acceptance levels, and allocate the necessary budget.

A retail company's business strategy is to become the lowest-cost provider in its market. The CISO proposes a comprehensive security program with advanced threat detection. The CFO objects, citing cost. How should the CISO respond to align security with the business strategy?

Argue that the CFO does not understand security and proceed with the full program.

Reduce security investment to the minimum required by law, regardless of risk.

Propose a tiered security program that matches investment levels to the risk of each business process, focusing on cost-effective controls.

Insist on the full program because security is non-negotiable.

Which stakeholder is typically responsible for the day-to-day implementation and operation of the information security program?

The Chief Information Security Officer (CISO)

The chief financial officer (CFO)

A newly appointed CISO is explaining to the executive team why the organization needs an information security governance program. The executives are skeptical, viewing security as an IT cost center. Which statement best articulates the purpose of security governance?

It reduces the security budget by eliminating redundant controls.

It provides a strategic framework that aligns security efforts with business objectives and ensures that risks are managed at the enterprise level.

It ensures that all security technologies are deployed and configured correctly.

It guarantees that the organization will never experience a data breach.

An e-commerce company's security program has been running for two years. The CISO wants to evaluate whether the program has achieved its strategic objectives. Which measure would provide the best evidence of success?

The percentage of employees who completed security awareness training.

The number of security policies that have been updated in the last year.

An increase in the number of security tools deployed across the environment.

A reduction in the number of successful cyberattacks and the estimated financial impact of those attacks.

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 2

Defining an Information Security Governance Program CCISO Practice Questions (Page 8)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

Questions 36–40

36application · medium
A global manufacturer is launching a new cloud-based product line. The CISO has prepared a risk assessment and a proposed security architecture. According to the principles of security governance, which action should the board take?
Select an answer first
37expert · hard
A retail company's business strategy is to become the lowest-cost provider in its market. The CISO proposes a comprehensive security program with advanced threat detection. The CFO objects, citing cost. How should the CISO respond to align security with the business strategy?
Select an answer first
38foundation · easy
Which stakeholder is typically responsible for the day-to-day implementation and operation of the information security program?
Select an answer first
39application · medium
A newly appointed CISO is explaining to the executive team why the organization needs an information security governance program. The executives are skeptical, viewing security as an IT cost center. Which statement best articulates the purpose of security governance?
Select an answer first
40application · medium
An e-commerce company's security program has been running for two years. The CISO wants to evaluate whether the program has achieved its strategic objectives. Which measure would provide the best evidence of success?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.