A small e-commerce company is designing security controls for its payment processing environment. The compliance team insists on implementing a compensating control because the primary control cannot be deployed due to legacy system limitations. Which example best illustrates a compensating control?

Implementing a manual review process for all payment transactions because automated fraud detection is not available

Purchasing cyber insurance to cover potential losses

Conducting quarterly vulnerability scans

Installing a firewall to protect the payment network

An organization is migrating its on-premises email system to a cloud-based service. As part of the migration, the CISO must ensure that security controls are integrated with the new system. What is the most important consideration when planning the deployment of security controls for the cloud email service?

Deploying all controls after the migration is complete to avoid disruption.

Using only cloud-native security features and disabling all third-party controls.

Ensuring the security controls are compatible with the cloud provider's API and can be automated.

Selecting controls that are identical to the on-premises controls to maintain consistency.

A security team is managing a mix of on-premises and cloud-based security controls. The CISO wants to ensure that all controls are consistently monitored and updated. Which strategy is most effective for managing this heterogeneous control environment?

Decommission all on-premises controls and move everything to the cloud to simplify management

Rely on each control vendor's individual management console without integration

Implement a centralized security orchestration, automation, and response (SOAR) platform to manage and monitor controls across both environments

Manage on-premises controls manually and use a separate cloud-native tool for cloud controls

A security team is managing a legacy encryption solution that is no longer compliant with current cryptographic standards. The team has identified a replacement, but the migration will require significant downtime. The organization cannot afford extended downtime. Which approach best manages this control lifecycle challenge?

Migrate all data in a single weekend, accepting the downtime

Plan a phased migration that moves data in batches during scheduled maintenance windows

Continue using the legacy encryption until a full maintenance window is available, even if it takes months

Disable encryption temporarily during the migration to speed up the process

A mid-sized healthcare organization is required to comply with HIPAA and is adopting a risk-based approach to security. The CISO wants to use a widely recognized framework that provides a structured process for identifying, assessing, and managing cybersecurity risk, while also allowing flexibility to tailor controls to the organization's specific risks. Which framework should the CISO select?

NIST Cybersecurity Framework (CSF)

EC-CouncilCertified Chief Information Security Officer

Domain 2Objective 1

Designing, Deploying, and Managing Security Controls CCISO Practice Questions (Page 1)

Part of the Information Security Controls and Audit Management domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 1–5

1application · medium
A small e-commerce company is designing security controls for its payment processing environment. The compliance team insists on implementing a compensating control because the primary control cannot be deployed due to legacy system limitations. Which example best illustrates a compensating control?
Select an answer first
2application · medium
An organization is migrating its on-premises email system to a cloud-based service. As part of the migration, the CISO must ensure that security controls are integrated with the new system. What is the most important consideration when planning the deployment of security controls for the cloud email service?
Select an answer first
3expert · hard
A security team is managing a mix of on-premises and cloud-based security controls. The CISO wants to ensure that all controls are consistently monitored and updated. Which strategy is most effective for managing this heterogeneous control environment?
Select an answer first
4expert · hard
A security team is managing a legacy encryption solution that is no longer compliant with current cryptographic standards. The team has identified a replacement, but the migration will require significant downtime. The organization cannot afford extended downtime. Which approach best manages this control lifecycle challenge?
Select an answer first
5application · medium
A mid-sized healthcare organization is required to comply with HIPAA and is adopting a risk-based approach to security. The CISO wants to use a widely recognized framework that provides a structured process for identifying, assessing, and managing cybersecurity risk, while also allowing flexibility to tailor controls to the organization's specific risks. Which framework should the CISO select?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Designing, Deploying, and Managing Security Controls CCISO Practice Questions (Page 1)

Questions 1–5

A security team is managing a mix of on-premises and cloud-based security controls. The CISO wants to ensure that all controls are consistently monitored and updated. Which strategy is most effective for managing this heterogeneous control environment?

Keep studying — Information Security Controls and Audit Management