Return on Investment (ROI) and Cost-Benefit Analysis CCISO Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A financial services firm is evaluating a multi-year security analytics platform. The platform costs $500,000 upfront and $100,000 per year in maintenance. The CISO projects annual benefits of $250,000 for five years. The firm's required rate of return is 10%. Which metric would best help the CISO decide whether to proceed, and what is the primary reason?

   • APayback period, because it shows how quickly the initial investment is recovered without needing a discount rate.
   • BNet present value (NPV), because it accounts for the time value of money and compares the present value of benefits to the present value of costs.
   • CInternal rate of return (IRR), because it calculates the exact dollar profit generated by the project.
   • DReturn on investment (ROI), because it measures the total profit over the project's life without discounting.
   Reveal Solution Discussion Select an answer first
2. 42application · easy

   A mid-sized retailer is considering a $240,000 investment in a new endpoint detection and response (EDR) solution. The CISO estimates that the solution will save $80,000 per year in avoided breach costs and $40,000 per year in reduced forensic investigation expenses. What is the payback period for this investment?

   • A2 years
   • B6 years
   • C4 years
   • D3 years
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company is evaluating a new security awareness training program. The program costs $30,000 to develop and $10,000 per year to maintain. It is expected to reduce phishing-related losses by $50,000 per year. What is the ROI for the first year?

   • A200%
   • B100%
   • C50%
   • D25%
   Reveal Solution Discussion Select an answer first
5. 44application · easy

   A CISO is preparing a cost-benefit analysis for a new encryption solution. The solution will cost $200,000 to implement and $50,000 per year to maintain. It is expected to reduce the likelihood of a data breach by 20%. The company's average breach cost is $2 million. What is the most important intangible benefit to include in the presentation?

   • AReduced likelihood of regulatory fines
   • BLower insurance premiums
   • CImproved customer confidence
   • DReduced incident response costs
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the primary purpose of a cost-benefit analysis (CBA) in security project decision-making?

   • ATo calculate the exact number of security incidents that will be prevented
   • BTo ensure that all security projects have equal budgets
   • CTo replace the need for executive approval of security projects
   • DTo compare the total costs and total benefits of a project to determine if it is worthwhile
   Reveal Solution Discussion Select an answer first