A CISO at a multinational corporation is tasked with establishing a security governance structure. The company operates in several countries with differing data protection laws and has multiple business units that currently create their own security policies. What should the CISO do to ensure consistent and compliant governance?

Outsource policy development to a consulting firm to ensure objectivity.

Create a single global security policy that overrides all local regulations for consistency.

Develop an enterprise security framework with a core policy and local addenda that address regional legal requirements.

Allow each business unit to maintain its own policies to accommodate local regulations.

What is the CISO's role in incident and crisis management?

To delegate all incident response to external parties

To wait for incidents to occur before planning

To lead the organization's preparation, response, and recovery efforts

To personally contain every security incident

Which practice best supports continuous improvement in a security program?

Conducting regular security audits and acting on findings

Keeping security metrics confidential from stakeholders

Avoiding audits to save time and resources

Implementing changes only after a major incident

A CISO is establishing a security governance structure for a multinational corporation. The company operates in several countries with conflicting data protection laws. What should the CISO do to ensure effective governance?

Develop a global framework with regional policies that comply with local laws and regulations.

Let each regional office create its own security policies without central oversight.

Create a single global security policy that applies uniformly to all regions.

Adopt the strictest country's laws as the global standard.

A CISO wants to demonstrate the effectiveness of the security program to the board. Which metric would be most meaningful to show improvement over time?

Number of security certifications held by staff.

Total number of security policies written.

Mean time to detect and respond to security incidents.

Number of security tools deployed in the environment.

EC-CouncilCertified Chief Information Security Officer

Domain 3Objective 1

The Role of the CISO CCISO Practice Questions (Page 6)

Part of the Security Program Management and Operations domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

12concepts

Questions 26–30

26application · medium
A CISO at a multinational corporation is tasked with establishing a security governance structure. The company operates in several countries with differing data protection laws and has multiple business units that currently create their own security policies. What should the CISO do to ensure consistent and compliant governance?
Select an answer first
27foundation · easy
What is the CISO's role in incident and crisis management?
Select an answer first
28foundation · easy
Which practice best supports continuous improvement in a security program?
Select an answer first
29application · medium
A CISO is establishing a security governance structure for a multinational corporation. The company operates in several countries with conflicting data protection laws. What should the CISO do to ensure effective governance?
Select an answer first
30application · medium
A CISO wants to demonstrate the effectiveness of the security program to the board. Which metric would be most meaningful to show improvement over time?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.