Return on Investment (ROI) and Cost-Benefit Analysis CCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A retail company is evaluating a new SIEM platform. The CISO has identified the following costs: $150,000 for software licenses, $40,000 for implementation consulting, $25,000 per year for maintenance, and an estimated $10,000 per year in staff time for administration. Which costs should be categorized as indirect costs?

   • AMaintenance and staff time
   • BNone of the costs are indirect
   • CStaff time for administration
   • DSoftware licenses and implementation consulting
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which cost category best describes the loss of customer trust after a data breach?

   • ADirect intangible cost
   • BDirect tangible cost
   • CIndirect tangible cost
   • DIndirect intangible cost
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A security project costs $50,000 and is expected to generate net benefits of $10,000 per year. What is the payback period?

   • A2 years
   • B10 years
   • C5 years
   • D50 years
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A CISO is comparing two security projects: a firewall upgrade and a security awareness program. The firewall upgrade has a clear, quantifiable benefit of reducing external attacks, while the awareness program has benefits that are harder to quantify but may reduce a broader range of incidents. The CISO has limited budget and must choose one. What is the most appropriate first step in the cost-benefit analysis?

   • AChoose the awareness program because it addresses a broader range of incidents.
   • BIdentify and categorize all costs and benefits for both projects, including intangible benefits.
   • CCalculate the ROI for the firewall upgrade first, since its benefits are easier to quantify.
   • DUse a qualitative comparison only, since the awareness program's benefits are intangible.
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A CISO is evaluating a multi-year security project with an initial cost of $1,000,000 and annual benefits of $300,000 for 5 years. The company's discount rate is 8%. The CISO wants to present a metric that accounts for the time value of money and is easy for the CFO to interpret. Which metric should be the primary focus?

   • APayback period
   • BNet present value (NPV)
   • CInternal rate of return (IRR)
   • DSimple ROI
   Reveal Solution Discussion Select an answer first