A CISO is presenting a business case for a new security tool. The ROI is highly sensitive to the assumed cost of a data breach. The CISO has used a breach cost of $5 million, but the CFO believes the actual cost could be as low as $2 million. What is the best way to address this in the presentation?

Present a range of ROI values based on different breach cost assumptions

Defend the $5 million figure as the industry standard

Focus on the payback period instead of ROI

Change the analysis to use $2 million to avoid conflict

What does net present value (NPV) account for that simple ROI does not?

The total cost of the investment

The number of security incidents prevented

The qualitative benefits of the investment

A CISO needs to present a cost-benefit analysis for a new data-loss prevention (DLP) system to the board of directors. The board is primarily concerned with regulatory compliance and brand reputation. What is the most effective way to present the analysis?

Include both quantified financial benefits and qualitative benefits such as compliance and reputation

Emphasize the technical features of the DLP system

Present only the ROI percentage and payback period

Focus on the tangible cost savings from reduced breach response

EC-CouncilCertified Chief Information Security Officer

Domain 5Objective 5

Return on Investment (ROI) and Cost-Benefit Analysis CCISO Practice Questions (Page 7)

Part of the Strategic Planning, Finance, Procurement, and Vendor Management domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~13–21 in this domain), expect 2–4 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

10concepts

Questions 31–35

31expert · medium
A CISO is presenting a business case for a new security tool. The ROI is highly sensitive to the assumed cost of a data breach. The CISO has used a breach cost of $5 million, but the CFO believes the actual cost could be as low as $2 million. What is the best way to address this in the presentation?
Select an answer first
32foundation · easy
What does net present value (NPV) account for that simple ROI does not?
Select an answer first
33application · medium
A CISO needs to present a cost-benefit analysis for a new data-loss prevention (DLP) system to the board of directors. The board is primarily concerned with regulatory compliance and brand reputation. What is the most effective way to present the analysis?
Select an answer first
34foundation · easy
A security project has total costs of $100,000 and net benefits of $150,000. What is the ROI?
Select an answer first
35application · easy
A healthcare organization is considering a $240,000 investment in a new endpoint detection and response (EDR) solution. The solution is expected to reduce incident response costs by $60,000 per year and avoid $20,000 in annual regulatory fines. What is the payback period for this investment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Return on Investment (ROI) and Cost-Benefit Analysis CCISO Practice Questions (Page 7)

Questions 31–35

What does net present value (NPV) account for that simple ROI does not?

A CISO needs to present a cost-benefit analysis for a new data-loss prevention (DLP) system to the board of directors. The board is primarily concerned with regulatory compliance and brand reputation. What is the most effective way to present the analysis?

A security project has total costs of $100,000 and net benefits of $150,000. What is the ROI?

A healthcare organization is considering a $240,000 investment in a new endpoint detection and response (EDR) solution. The solution is expected to reduce incident response costs by $60,000 per year and avoid $20,000 in annual regulatory fines. What is the payback period for this investment?

Keep studying — Strategic Planning, Finance, Procurement, and Vendor Management