What is the primary purpose of an incident response plan?

To replace the need for security monitoring

To provide a structured approach for detecting, responding to, and recovering from security incidents

To prevent all security incidents from occurring

To assign blame to individuals responsible for the incident

An organization's security awareness program is not reducing the number of incidents caused by employees clicking on malicious links. The CISO wants to improve the program. Which action is most likely to be effective?

Increase the length of the annual training and make it mandatory for all employees.

Discipline employees who click on malicious links to deter future behavior.

Implement a phishing simulation program with immediate feedback and track results over time.

Replace the training with a technical solution that blocks all malicious links.

A CISO is developing the annual security plan. The company's strategic objective is to expand into new international markets. How should the CISO align the security program with this objective?

Implement the same security measures as competitors to ensure parity.

Focus on reducing the security budget to free up resources for market expansion.

Prioritize security initiatives that support secure market expansion, such as compliance with international regulations and data protection.

Delay all security initiatives until the market expansion is complete.

What is the role of an internal audit in relation to an information security program?

To implement all security controls

To write the organization's security policies

To make final decisions on risk acceptance

To provide independent assurance that security controls are operating effectively

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 1

Information Security Management Program CCISO Practice Questions (Page 6)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

Questions 26–30

26foundation · easy
What is the primary purpose of an incident response plan?
Select an answer first
27application · medium
An organization's security awareness program is not reducing the number of incidents caused by employees clicking on malicious links. The CISO wants to improve the program. Which action is most likely to be effective?
Select an answer first
28foundation · easy
Which document type would typically specify the mandatory technical configuration for a firewall?
Select an answer first
29application · medium
A CISO is developing the annual security plan. The company's strategic objective is to expand into new international markets. How should the CISO align the security program with this objective?
Select an answer first
30foundation · easy
What is the role of an internal audit in relation to an information security program?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.