A government contractor must assess the effectiveness of its security controls against the NIST SP 800-53 framework. The CISO wants to ensure that the assessment provides a comprehensive view of control implementation. Which assessment method is most appropriate for this purpose?

Ask system owners to self-certify that their controls are effective.

Use only the results of the most recent external audit.

Combine automated testing, document review, and interviews with system owners.

Rely solely on automated vulnerability scanning results.

A bank has adopted the COBIT framework and is implementing the 'Manage Security Services' process. The CISO needs to ensure that the implementation includes proper segregation of duties. Which action is most critical for this control?

Implement a new firewall to protect the network perimeter.

Purchase a new SIEM tool to monitor security events.

Conduct a security awareness training session for all employees.

Define roles and responsibilities so that no single individual has control over conflicting functions.

An organization has implemented the CIS Controls and wants to measure the effectiveness of its controls. The CISO needs to report to the board on the security posture. Which metric would be most meaningful for the board?

Percentage of CIS Controls implemented and the results of control tests.

Number of security tools purchased in the last quarter.

Number of employees who completed security awareness training.

Total number of security alerts generated.

An organization has implemented controls based on COBIT 2019. The CISO wants to assess whether the controls are meeting the organization's governance objectives. Which assessment method is most appropriate?

Evaluate control outcomes against the organization's goals and key performance indicators (KPIs).

Rely on the external auditor's opinion without internal measurement.

Compare the organization's controls to a generic industry checklist without considering business context.

Focus only on technical vulnerability scans to determine control effectiveness.

A multinational organization must comply with both GDPR and the U.S. CLOUD Act, which have conflicting requirements regarding data access. The CISO needs to select a control assurance framework that helps manage these conflicts. What is the most appropriate approach?

Avoid using any framework to prevent drawing attention to the conflict.

Select a framework that guarantees full compliance with both regulations simultaneously.

Use a framework that supports risk-based decision-making and document the trade-offs in the risk register.

Choose a framework that only addresses GDPR and ignore the CLOUD Act.

EC-CouncilCertified Chief Information Security Officer

Domain 2Objective 3

Implementing Control Assurance Frameworks CCISO Practice Questions (Page 2)

Part of the Information Security Controls and Audit Management domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

5concepts

Questions 6–10

6application · medium
A government contractor must assess the effectiveness of its security controls against the NIST SP 800-53 framework. The CISO wants to ensure that the assessment provides a comprehensive view of control implementation. Which assessment method is most appropriate for this purpose?
Select an answer first
7application · medium
A bank has adopted the COBIT framework and is implementing the 'Manage Security Services' process. The CISO needs to ensure that the implementation includes proper segregation of duties. Which action is most critical for this control?
Select an answer first
8application · medium
An organization has implemented the CIS Controls and wants to measure the effectiveness of its controls. The CISO needs to report to the board on the security posture. Which metric would be most meaningful for the board?
Select an answer first
9application · medium
An organization has implemented controls based on COBIT 2019. The CISO wants to assess whether the controls are meeting the organization's governance objectives. Which assessment method is most appropriate?
Select an answer first
10expert · hard
A multinational organization must comply with both GDPR and the U.S. CLOUD Act, which have conflicting requirements regarding data access. The CISO needs to select a control assurance framework that helps manage these conflicts. What is the most appropriate approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.