A security team is deploying a new security information and event management (SIEM) system. The deployment must integrate with existing legacy log sources and meet a strict go-live deadline. The team has limited staff. Which deployment approach is most likely to succeed?

Attempt to integrate all log sources at once to meet the deadline

Delay the go-live date until all log sources are integrated

Deploy the SIEM without integrating any log sources, then add them later

Start with a core set of high-value log sources, then expand integration incrementally after go-live

A security team is managing a legacy intrusion detection system (IDS) that is nearing end-of-life. The vendor will no longer provide signature updates after the next quarter. The team has identified a modern replacement, but the migration will take six months. What should the team do first to manage the control lifecycle effectively?

Continue using the legacy IDS without changes until the replacement is fully deployed

Decommission the legacy IDS immediately to reduce maintenance effort

Begin the migration immediately while continuing to monitor the legacy IDS and documenting its limitations

Disable the legacy IDS and rely solely on the new system once it is installed, without a transition period

An organization is preparing for an external audit against ISO/IEC 27001. The auditor will review the design and operation of security controls. What should the CISO ensure is in place to support the audit process?

Documentation of control objectives, implementation evidence, and monitoring results.

A copy of the vendor's ISO 27001 certificate for all security products.

A list of all security incidents from the past year.

A signed statement from the CEO that all controls are effective.

After deploying a new data loss prevention (DLP) solution, the CISO wants to verify that it is actually preventing unauthorized data exfiltration. Which approach provides the most reliable evidence of control effectiveness?

Conduct a penetration test that attempts to exfiltrate sample data through various channels

Review the DLP vendor's marketing materials and feature list

Check that the DLP console shows a green status indicator

Ask the security team if they believe the DLP is working

A financial institution is preparing for an external audit against ISO 27001. The auditor will require evidence that security controls are operating effectively. Which action best prepares the organization for this audit?

Maintain a control matrix that maps each control to the ISO 27001 annex and includes recent test results

Ask the auditor to sign a non-disclosure agreement before sharing any information

Provide the auditor with the organization's security policy documents only

Wait until the auditor arrives to collect evidence

EC-CouncilCertified Chief Information Security Officer

Domain 2Objective 1

Designing, Deploying, and Managing Security Controls CCISO Practice Questions (Page 4)

Part of the Information Security Controls and Audit Management domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 16–20

16expert · hard
A security team is deploying a new security information and event management (SIEM) system. The deployment must integrate with existing legacy log sources and meet a strict go-live deadline. The team has limited staff. Which deployment approach is most likely to succeed?
Select an answer first
17application · medium
A security team is managing a legacy intrusion detection system (IDS) that is nearing end-of-life. The vendor will no longer provide signature updates after the next quarter. The team has identified a modern replacement, but the migration will take six months. What should the team do first to manage the control lifecycle effectively?
Select an answer first
18application · medium
An organization is preparing for an external audit against ISO/IEC 27001. The auditor will review the design and operation of security controls. What should the CISO ensure is in place to support the audit process?
Select an answer first
19application · medium
After deploying a new data loss prevention (DLP) solution, the CISO wants to verify that it is actually preventing unauthorized data exfiltration. Which approach provides the most reliable evidence of control effectiveness?
Select an answer first
20application · medium
A financial institution is preparing for an external audit against ISO 27001. The auditor will require evidence that security controls are operating effectively. Which action best prepares the organization for this audit?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.