A multinational corporation has a policy that all employees must complete annual security awareness training. The training is mandatory, and completion is tracked. However, the company has experienced several phishing incidents where employees clicked on malicious links. The CISO wants to reduce the number of successful phishing attacks. Which control type should be added to complement the existing training?

A detective control that monitors email traffic for phishing indicators and alerts the security team

A deterrent control that displays a warning banner on all incoming emails

A corrective control that automatically resets passwords for employees who click on phishing links

A preventive technical control that filters phishing emails before they reach employee inboxes

A retail company is implementing security controls for its point-of-sale (POS) system. A risk assessment identified that a malware infection could compromise cardholder data, and the company must comply with PCI DSS. Which control selection best addresses the identified risk while meeting the regulatory requirement?

Deploying endpoint protection software on all POS terminals and regularly updating malware signatures

Installing a firewall between the POS network and the corporate network

Implementing a security awareness training program for all store employees

Conducting quarterly vulnerability scans of the POS network

A manufacturing company wants to prevent unauthorized personnel from entering its server room. The security manager is considering several options. Which option is classified as a physical control?

Installing a biometric fingerprint scanner on the server room door

Configuring the building's electronic access control system to log all badge swipes

Deploying a video surveillance system that records everyone entering the server room

Implementing a role-based access control policy that restricts server room access to IT staff

EC-CouncilCertified Chief Information Security Officer

Domain 2Objective 2

Security Control Types and Objectives CCISO Practice Questions (Page 4)

Part of the Information Security Controls and Audit Management domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 16–20

16expert · hard
A multinational corporation has a policy that all employees must complete annual security awareness training. The training is mandatory, and completion is tracked. However, the company has experienced several phishing incidents where employees clicked on malicious links. The CISO wants to reduce the number of successful phishing attacks. Which control type should be added to complement the existing training?
Select an answer first
17application · medium
A retail company is implementing security controls for its point-of-sale (POS) system. A risk assessment identified that a malware infection could compromise cardholder data, and the company must comply with PCI DSS. Which control selection best addresses the identified risk while meeting the regulatory requirement?
Select an answer first
18application · medium
A manufacturing company wants to prevent unauthorized personnel from entering its server room. The security manager is considering several options. Which option is classified as a physical control?
Select an answer first
19foundation · easy
A security administrator installs motion sensors and video cameras at the entrance of a data center. Which type of security control do these devices primarily represent?
Select an answer first
20foundation · easy
When selecting security controls, an organization first identifies its assets, threats, and vulnerabilities, and then evaluates the likelihood and impact of potential incidents. Which process does this describe?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Security Control Types and Objectives CCISO Practice Questions (Page 4)

Questions 16–20

A manufacturing company wants to prevent unauthorized personnel from entering its server room. The security manager is considering several options. Which option is classified as a physical control?

A security administrator installs motion sensors and video cameras at the entrance of a data center. Which type of security control do these devices primarily represent?

When selecting security controls, an organization first identifies its assets, threats, and vulnerabilities, and then evaluates the likelihood and impact of potential incidents. Which process does this describe?

Keep studying — Information Security Controls and Audit Management