An organization is developing a new remote work policy. The CISO wants to ensure the policy is enforceable and aligned with the security program. What is the most important consideration?

Defining clear roles and responsibilities for enforcing the policy and consequences for non-compliance.

Including specific technical requirements such as VPN usage and device encryption.

Ensuring the policy is reviewed and approved by the legal department.

Aligning the policy with the latest industry best practices for remote work.

What is the primary purpose of budgeting for an information security program?

To maximize the security team's spending without oversight

To match the budget of competitors

To allocate financial resources to security initiatives based on risk priorities

To reduce the security budget to the minimum possible

What is the primary purpose of an information security management program (ISMP) within an organization?

To ensure that all employees have the latest security software installed on their personal devices

To guarantee that the organization experiences zero security incidents at all times

To establish a framework that protects the confidentiality, integrity, and availability of information assets while aligning with business objectives

To satisfy the requirements of external auditors without regard to business needs

An organization is preparing for its annual ISO 27001 surveillance audit. The auditor has requested evidence of management review. The CISO has been holding monthly security meetings with the IT director, but there is no formal documentation of these meetings. The auditor requires documented evidence that top management reviews the security program's performance. What should the CISO do?

Explain to the auditor that the monthly meetings with the IT director constitute management review, even though they are informal.

Backdate meeting minutes for the past year to show that management review has been occurring.

Create a formal management review meeting with a documented agenda, minutes, and action items, and hold it at least annually.

Ask the IT director to sign a statement confirming that management review has been occurring informally.

What is the primary purpose of an information security policy?

To specify the exact technical configuration for all network devices

To provide high-level direction and management expectations for protecting information assets

To provide step-by-step instructions for performing a specific task

To replace the need for standards and procedures

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 1

Information Security Management Program CCISO Practice Questions (Page 7)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

10concepts

Questions 31–35

31application · medium
An organization is developing a new remote work policy. The CISO wants to ensure the policy is enforceable and aligned with the security program. What is the most important consideration?
Select an answer first
32foundation · easy
What is the primary purpose of budgeting for an information security program?
Select an answer first
33foundation · easy
What is the primary purpose of an information security management program (ISMP) within an organization?
Select an answer first
34application · medium
An organization is preparing for its annual ISO 27001 surveillance audit. The auditor has requested evidence of management review. The CISO has been holding monthly security meetings with the IT director, but there is no formal documentation of these meetings. The auditor requires documented evidence that top management reviews the security program's performance. What should the CISO do?
Select an answer first
35foundation · easy
What is the primary purpose of an information security policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.