A CISO must present the quarterly risk report to the board of directors. The board is primarily concerned with strategic objectives and capital allocation. The full risk register contains 200 detailed risks with technical descriptions. What is the most effective way to communicate risk information to this audience?

Distribute a technical report listing each risk's CVSS score and exploitability details.

Present a heat map showing the top 10 risks by severity, with a summary of potential business impact and recommended actions.

Focus exclusively on risks that have a financial impact of over $1 million, excluding all others.

Provide the complete risk register so the board can review every risk in detail.

A university is implementing a new student information system that will store sensitive personal data. The CISO is conducting a risk identification workshop. Which of the following is the most important input to this workshop?

A list of all known vulnerabilities in the system's software.

A detailed inventory of the data assets and their classification levels.

The university's marketing plan for the new system.

The project budget and timeline for the system implementation.

In the context of an enterprise governance, risk, and compliance (GRC) program, what is the primary purpose of risk management?

To ensure that all risks are documented in a risk register for compliance purposes

To transfer all operational risks to third-party insurance providers

To identify, assess, and respond to uncertainties that could affect the achievement of organizational objectives

To eliminate all potential threats to the organization's assets

A company has a formal risk management framework, but employees in the sales department routinely accept high-risk deals without consulting the risk team. The CISO wants to embed risk awareness into the sales process. Which approach is most likely to succeed?

Provide additional risk training to the sales team on an annual basis.

Reward sales employees for closing deals quickly, regardless of risk.

Require sales managers to complete a risk assessment checklist before approving any deal above a certain value.

Create a new policy that all deals must be reviewed by the risk team.

A multinational corporation is establishing a new enterprise risk management program and wants to align it with international best practices. The CISO needs a framework that is principles-based, applicable to all types of risk, and provides guidance on leadership commitment and continual improvement. Which framework should the CISO select?

NIST SP 800-37, which focuses on the risk management framework for federal information systems.

PCI DSS, which specifies security requirements for organizations that handle cardholder data.

ISO 31000, which provides principles, a framework, and a process for managing any type of risk.

COBIT 2019, which is designed primarily for IT governance and management objectives.

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 4

Risk Management CCISO Practice Questions (Page 2)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 6–10

6application · medium
A CISO must present the quarterly risk report to the board of directors. The board is primarily concerned with strategic objectives and capital allocation. The full risk register contains 200 detailed risks with technical descriptions. What is the most effective way to communicate risk information to this audience?
Select an answer first
7application · medium
A university is implementing a new student information system that will store sensitive personal data. The CISO is conducting a risk identification workshop. Which of the following is the most important input to this workshop?
Select an answer first
8foundation · easy
In the context of an enterprise governance, risk, and compliance (GRC) program, what is the primary purpose of risk management?
Select an answer first
9expert · hard
A company has a formal risk management framework, but employees in the sales department routinely accept high-risk deals without consulting the risk team. The CISO wants to embed risk awareness into the sales process. Which approach is most likely to succeed?
Select an answer first
10application · medium
A multinational corporation is establishing a new enterprise risk management program and wants to align it with international best practices. The CISO needs a framework that is principles-based, applicable to all types of risk, and provides guidance on leadership commitment and continual improvement. Which framework should the CISO select?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Risk Management CCISO Practice Questions (Page 2)

Questions 6–10

A university is implementing a new student information system that will store sensitive personal data. The CISO is conducting a risk identification workshop. Which of the following is the most important input to this workshop?

In the context of an enterprise governance, risk, and compliance (GRC) program, what is the primary purpose of risk management?

A company has a formal risk management framework, but employees in the sales department routinely accept high-risk deals without consulting the risk team. The CISO wants to embed risk awareness into the sales process. Which approach is most likely to succeed?

Keep studying — Governance, Risk, and Compliance