A retail company is expanding into a new country and will begin processing customer payment data there. The CISO is updating the risk register. Which risk should be identified as a NEW risk introduced by this expansion?

The risk of hardware failure in the company's existing on-premises data center.

The risk of employee dissatisfaction with the company's current benefits package.

The existing risk of phishing attacks on the company's email system, which remains unchanged.

Non-compliance with the new country's data protection regulations, which could result in fines and legal action.

A CISO is preparing the quarterly risk report for the executive committee. The report should highlight the top risks and the status of risk treatment plans. Which format would be most effective for this audience?

A dashboard showing key risk indicators, top risks, and the status of mitigation efforts.

A verbal update with no written documentation.

A raw data dump from the risk management software.

A detailed technical report with all vulnerabilities and their CVSS scores.

What is the role of internal audit in relation to risk management?

To eliminate all risks identified by the risk management process

To provide independent assurance on the effectiveness of risk management processes

To make decisions on which risks to accept or transfer

To implement all risk mitigation controls

What is the primary purpose of risk evaluation and prioritization?

To rank risks based on their severity and the organization's risk appetite

To implement controls to reduce the likelihood of risks

To determine the exact probability of each risk occurring

To identify all potential risks that could affect the organization

A healthcare organization has implemented a risk treatment plan to reduce the likelihood of a data breach by encrypting all portable devices and enforcing multi-factor authentication. Six months later, the CISO wants to verify that these controls are still effective and that no new risks have emerged. Which action should the CISO take?

Schedule periodic risk reviews and track key risk indicators (KRIs) related to device encryption and authentication failures.

Conduct a one-time audit of the encryption and MFA configurations.

Wait until the next annual risk assessment to evaluate the controls.

Rely on the vendor's assurance that the encryption and MFA products are effective.

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 4

Risk Management CCISO Practice Questions (Page 3)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

10concepts

Questions 11–15

11application · medium
A retail company is expanding into a new country and will begin processing customer payment data there. The CISO is updating the risk register. Which risk should be identified as a NEW risk introduced by this expansion?
Select an answer first
12application · medium
A CISO is preparing the quarterly risk report for the executive committee. The report should highlight the top risks and the status of risk treatment plans. Which format would be most effective for this audience?
Select an answer first
13foundation · easy
What is the role of internal audit in relation to risk management?
Select an answer first
14foundation · easy
What is the primary purpose of risk evaluation and prioritization?
Select an answer first
15application · medium
A healthcare organization has implemented a risk treatment plan to reduce the likelihood of a data breach by encrypting all portable devices and enforcing multi-factor authentication. Six months later, the CISO wants to verify that these controls are still effective and that no new risks have emerged. Which action should the CISO take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.