Return on Investment (ROI) and Cost-Benefit Analysis CCISO Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A CISO is presenting a business case for a new identity and access management (IAM) platform. The initial ROI calculation assumes a 30% reduction in account takeover incidents, each costing $50,000. The CISO is concerned that the incident cost estimate is uncertain. Which approach best addresses this uncertainty in the presentation to the CFO?

   • AReplace the incident cost estimate with a qualitative benefit description to avoid the uncertainty.
   • BRun a sensitivity analysis that varies the incident cost from $25,000 to $75,000 and show the resulting ROI range.
   • CUse a higher discount rate to account for the uncertainty in the incident cost estimate.
   • DPresent a single ROI figure using the most likely incident cost, and note that the estimate is based on industry benchmarks.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How can an intangible benefit such as 'risk reduction' be incorporated into a cost-benefit analysis?

   • ABy excluding it from the analysis because it cannot be measured
   • BBy using it only in the payback period calculation
   • CBy assigning a monetary value using estimation techniques such as expected loss avoidance
   • DBy treating it as a cost rather than a benefit
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A CISO needs to convince the board to approve a $2M security operations center (SOC) upgrade. The CISO has calculated an NPV of $500,000 over five years. The board is concerned about the immediate cash outlay. Which presentation strategy is most effective in addressing the board's concern?

   • ALower the discount rate to make the NPV appear larger, making the investment more attractive.
   • BEmphasize the NPV figure and explain that it already accounts for the time value of money, so the $2M outlay is justified.
   • CPresent the payback period alongside the NPV, showing how quickly the investment will be recovered.
   • DPresent only the total benefits over five years, since the board is focused on the big picture.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When presenting a cost-benefit analysis to executive stakeholders, what is the most effective way to communicate the results?

   • APresent the analysis only to the IT team to avoid confusion
   • BFocus on technical details of the security controls
   • CPresent a clear summary of costs, benefits, ROI, and payback period in business terms
   • DProvide only the qualitative benefits without financial figures
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is evaluating a move to a cloud-based security solution. The CISO has identified the following: monthly subscription fees, reduced need for on-premises hardware, potential downtime during migration, and improved scalability. Which of these should be classified as indirect costs?

   • APotential downtime during migration
   • BReduced need for on-premises hardware
   • CImproved scalability
   • DMonthly subscription fees
   Reveal Solution Discussion Select an answer first