A university is integrating a new requirement that all research data containing personally identifiable information (PII) must be encrypted at rest. The research department argues that encryption will slow down data analysis. The CISO must translate this requirement into an operational specification. What is the most appropriate action?

Define the encryption standard, identify the specific storage locations where PII resides, and specify when encryption should be applied (e.g., at rest, during transfer) while considering performance impacts.

Require all research data to be moved to a single centralized storage system with encryption enabled.

Tell the research department that encryption is non-negotiable and they must accept the performance impact.

Purchase the most expensive encryption software available to ensure the best performance.

A financial institution has integrated a security requirement into its loan approval process that requires a second-level review for all loans above $100,000. After a year, the institution notices that the review step is often waived for certain high-profile clients. The CISO must improve the integration. What is the most effective action?

Conduct a root-cause analysis to understand why the review is waived and redesign the process to make the waiver require explicit risk acceptance

Increase the loan threshold to $250,000 to reduce the number of reviews

Eliminate the second-level review for all loans to simplify the process

Automatically reject any loan that does not have the second-level review

EC-CouncilCertified Chief Information Security Officer

Domain 3Objective 3

Integrating Security Requirements into Operational Processes CCISO Practice Questions (Page 11)

Part of the Security Program Management and Operations domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

7concepts

Questions 51–52

51application · medium
A university is integrating a new requirement that all research data containing personally identifiable information (PII) must be encrypted at rest. The research department argues that encryption will slow down data analysis. The CISO must translate this requirement into an operational specification. What is the most appropriate action?
Select an answer first
52expert · hard
A financial institution has integrated a security requirement into its loan approval process that requires a second-level review for all loans above $100,000. After a year, the institution notices that the review step is often waived for certain high-profile clients. The CISO must improve the integration. What is the most effective action?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Integrating Security Requirements into Operational Processes CCISO Practice Questions (Page 11)

Questions 51–52

Keep studying — Security Program Management and Operations