In a cost-benefit analysis for a security project, what is the typical first step?

Obtain executive sign-off on the project budget

Select the security technology vendor

Calculate the net present value of the project

Identify all relevant costs and benefits associated with the project

A CISO is presenting a business case for a new security awareness training program. The initial ROI calculation assumes a 30% reduction in phishing click rates. During the presentation, the CFO asks how the ROI would change if the reduction were only 15%. What is the most appropriate response?

Recalculate the ROI using the 15% reduction and present both scenarios

Explain that the 30% reduction is a conservative estimate and the ROI will be higher

State that the ROI is not sensitive to the click-rate reduction

Ask the CFO to approve the program based on the original estimate

A CISO is building a business case for a new vulnerability management program. The CISO has quantified the following benefits: $100,000 per year in avoided breach costs, $50,000 per year in reduced audit findings, and improved security posture. How should the CISO present the 'improved security posture' benefit?

Exclude it from the analysis because it cannot be measured.

Include it in the NPV calculation as a non-cash benefit.

As a qualitative benefit, since it is intangible and difficult to quantify reliably.

As a direct dollar value based on the cost of a potential breach.

When evaluating a security project with NPV, what does a positive NPV indicate?

The project's discounted benefits exceed its discounted costs

The project will break even exactly

The project's payback period is less than one year

What does return on investment (ROI) measure in the context of a security investment?

The total cost of the security investment over its entire lifecycle

The number of security incidents prevented by the investment

The time required for the investment to pay for itself

The financial gain or loss generated by the investment relative to its cost

EC-CouncilCertified Chief Information Security Officer

Domain 5Objective 5

Return on Investment (ROI) and Cost-Benefit Analysis CCISO Practice Questions (Page 1)

Part of the Strategic Planning, Finance, Procurement, and Vendor Management domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~13–21 in this domain), expect 2–4 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

10concepts

Questions 1–5

1foundation · easy
In a cost-benefit analysis for a security project, what is the typical first step?
Select an answer first
2expert · medium
A CISO is presenting a business case for a new security awareness training program. The initial ROI calculation assumes a 30% reduction in phishing click rates. During the presentation, the CFO asks how the ROI would change if the reduction were only 15%. What is the most appropriate response?
Select an answer first
3application · medium
A CISO is building a business case for a new vulnerability management program. The CISO has quantified the following benefits: $100,000 per year in avoided breach costs, $50,000 per year in reduced audit findings, and improved security posture. How should the CISO present the 'improved security posture' benefit?
Select an answer first
4foundation · easy
When evaluating a security project with NPV, what does a positive NPV indicate?
Select an answer first
5foundation · easy
What does return on investment (ROI) measure in the context of a security investment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.