Which of the following is an example of a physical security control?

An encryption algorithm used to protect data at rest

A firewall rule that blocks unauthorized inbound traffic

A biometric access control system on a data center door

A security policy requiring employees to use strong passwords

Which activity is part of the ongoing monitoring and maintenance phase of a security control's lifecycle?

Reviewing logs and alerts generated by the control

Selecting the control for the first time

Performing a risk assessment to decide if the control is needed

Decommissioning the control after initial deployment

A security architect is designing controls for a new cloud-based application that processes highly sensitive data. The architect must balance defense in depth with cost and operational complexity. Which approach best achieves this balance?

Implement a single, strong control at each layer (network, application, data) to reduce complexity.

Rely on the cloud provider's built-in security controls and avoid additional controls to reduce cost.

Implement multiple overlapping controls at each layer, prioritizing high-risk areas and using cost-effective options where possible.

Implement the most expensive controls available to ensure maximum security.

What is the primary purpose of security metrics in control effectiveness assessment?

To replace the need for regular audits

To provide quantitative data that can be used to measure and track control performance over time

To justify the budget for security controls

To satisfy regulatory requirements only

EC-CouncilCertified Chief Information Security Officer

Domain 2Objective 1

Designing, Deploying, and Managing Security Controls CCISO Practice Questions (Page 2)

Part of the Information Security Controls and Audit Management domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 6–10

6foundation · easy
Which of the following is an example of a physical security control?
Select an answer first
7foundation · easy
Which activity is part of the ongoing monitoring and maintenance phase of a security control's lifecycle?
Select an answer first
8expert · hard
A security architect is designing controls for a new cloud-based application that processes highly sensitive data. The architect must balance defense in depth with cost and operational complexity. Which approach best achieves this balance?
Select an answer first
9foundation · easy
What is the primary purpose of security metrics in control effectiveness assessment?
Select an answer first
10foundation · easy
Which security control framework is an international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.