Return on Investment (ROI) and Cost-Benefit Analysis CCISO Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A CISO has calculated an ROI of 40% for a security project based on an assumed 20% reduction in breach likelihood. The CISO is unsure about this assumption. Which action would provide the most useful information to decision-makers?

   • AUse a higher discount rate to compensate for the uncertainty.
   • BPresent the ROI as a single figure and note that the assumption is based on industry data.
   • CAbandon the ROI calculation and use only qualitative benefits.
   • DRecalculate ROI using a 10% and 30% reduction to show a range of outcomes.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the purpose of sensitivity analysis in a cost-benefit analysis for a security project?

   • ATo ensure the project has no financial risks
   • BTo calculate the exact ROI of the project
   • CTo determine how changes in key assumptions affect the outcome of the analysis
   • DTo identify all possible security threats to the project
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A CISO is presenting a cost-benefit analysis for a new multi-factor authentication (MFA) system. The system costs $100,000 to implement and $20,000 per year to maintain. It is expected to reduce account takeover incidents by 50%. The average cost of an account takeover is $50,000, and the company experiences 10 per year. What is the most compelling way to present the benefits to the CFO?

   • APresent the payback period of 2 years
   • BFocus on the reduction in account takeover incidents
   • CPresent the annual cost savings of $250,000
   • DPresent the ROI as 250%
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is an example of an indirect cost for a security initiative?

   • AThe license fee for a new intrusion detection system
   • BThe cost of the hardware server that hosts the security tool
   • CThe cost of productivity loss while employees undergo security awareness training
   • DThe salary of the security engineer who configures the system
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A CISO is comparing two security investments. Project X has an IRR of 18% and a payback period of 3 years. Project Y has an IRR of 15% and a payback period of 2 years. The company's cost of capital is 12%. Both projects have similar risk. Which project should the CISO recommend?

   • AProject Y, because a shorter payback period is more important than IRR when the cost of capital is low.
   • BProject X, because its IRR is higher and both projects exceed the cost of capital, so the higher IRR indicates greater value creation.
   • CProject X, because it has a higher IRR, which indicates a higher return on investment.
   • DProject Y, because it has a shorter payback period, which reduces risk.
   Reveal Solution Discussion Select an answer first