Which of the following is a common method used to assess the effectiveness of implemented controls?

Reviewing control documentation and conducting interviews with control owners

Assuming that if a control exists, it is effective

Relying solely on the vendor's marketing claims about the control

Waiting for a security incident to reveal weaknesses

A cloud service provider must assess the effectiveness of its security controls against the Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM). The CISO wants to ensure that the assessment covers both technical and organizational controls. Which assessment approach is most appropriate?

Send a survey to all customers asking about their satisfaction with security.

Perform a penetration test on the cloud infrastructure.

Review the cloud provider's SOC 2 report only.

Use a combination of automated configuration checks, policy reviews, and employee interviews.

A hospital has implemented a control assurance framework and wants to establish a continuous monitoring process for its medical device security controls. The CISO needs to ensure that monitoring is effective and sustainable. Which approach is most appropriate?

Conduct an annual risk assessment of all medical devices.

Automate the collection of security metrics from medical devices and integrate them into a central dashboard.

Assign a security analyst to manually review device logs every month.

Rely on the device manufacturers to report security issues.

What is the first step in planning the implementation of controls defined by an assurance framework?

Immediately implementing all controls simultaneously

Purchasing new security software

Conducting a gap analysis to compare current controls against framework requirements

A technology company has implemented a control assurance framework and wants to establish a continuous monitoring process. The CISO needs to ensure that control effectiveness is tracked over time and that improvements are made. Which action is most essential for a successful continuous monitoring program?

Assign a single security analyst to review all control reports monthly.

Conduct an annual internal audit of all controls to identify weaknesses.

Purchase a new SIEM tool to collect logs from all systems.

Define key risk indicators (KRIs) and key performance indicators (KPIs) that align with control objectives.

EC-CouncilCertified Chief Information Security Officer

Domain 2Objective 3

Implementing Control Assurance Frameworks CCISO Practice Questions (Page 3)

Part of the Information Security Controls and Audit Management domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

5concepts

Questions 11–15

11foundation · easy
Which of the following is a common method used to assess the effectiveness of implemented controls?
Select an answer first
12application · medium
A cloud service provider must assess the effectiveness of its security controls against the Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM). The CISO wants to ensure that the assessment covers both technical and organizational controls. Which assessment approach is most appropriate?
Select an answer first
13application · medium
A hospital has implemented a control assurance framework and wants to establish a continuous monitoring process for its medical device security controls. The CISO needs to ensure that monitoring is effective and sustainable. Which approach is most appropriate?
Select an answer first
14foundation · easy
What is the first step in planning the implementation of controls defined by an assurance framework?
Select an answer first
15application · medium
A technology company has implemented a control assurance framework and wants to establish a continuous monitoring process. The CISO needs to ensure that control effectiveness is tracked over time and that improvements are made. Which action is most essential for a successful continuous monitoring program?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.