Return on Investment (ROI) and Cost-Benefit Analysis CCISO Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is ROI analysis important when evaluating security investments?

   • AIt provides a standardized financial measure to compare the value of different security projects
   • BIt guarantees that the security investment will prevent all future breaches
   • CIt eliminates the need for qualitative risk assessments
   • DIt determines the exact number of security controls required for compliance
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   If a security investment yields an ROI of 80%, what does this indicate?

   • AThe net benefits are 80% of the total costs
   • BThe payback period is 80 months
   • CThe total costs are 80% of the net benefits
   • DThe investment lost 20% of its value
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Why is it important to include risk reduction as a benefit when presenting a security project's CBA to executives?

   • ABecause risk reduction is the only benefit that matters to executives
   • BBecause it helps justify the investment by linking security to business risk management
   • CBecause it eliminates the need to quantify other benefits
   • DBecause it guarantees the project will be approved
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   A small business is considering a $50,000 investment in a new firewall. The firewall is expected to reduce the risk of a breach by 10%. The average cost of a breach for this business is $500,000. What is the payback period?

   • A2 years
   • B1 year
   • C10 years
   • D5 years
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A CISO is building a business case for a data loss prevention (DLP) solution. The CISO has quantified the following benefits: $150,000 per year in avoided regulatory fines, $75,000 per year in reduced breach investigation costs, and improved customer trust. How should the CISO treat the 'improved customer trust' benefit in the cost-benefit analysis?

   • AInclude it in the NPV calculation as a non-cash benefit.
   • BAssign a conservative dollar value based on a survey of customer willingness to pay.
   • CInclude it as a qualitative benefit in the presentation, alongside the quantified benefits.
   • DExclude it entirely because it cannot be measured in dollars.
   Reveal Solution Discussion Select an answer first