During a major data breach, a company's CISO is coordinating the incident response. The CEO wants to issue a public statement immediately, but legal counsel advises waiting until the investigation confirms the scope. What should the CISO do?

Advise the CEO to wait for a preliminary assessment and coordinate messaging with legal and communications teams.

Refuse to communicate with the CEO until the investigation is complete.

Let the legal team make all decisions about public communication.

Support the CEO and issue a statement immediately to maintain public trust.

A newly appointed CISO at a mid-sized company discovers that the security team reports to the IT director and has no direct access to the CEO or board. The CISO wants to elevate the security function's strategic influence. What should the CISO do first?

Keep the current reporting structure and focus only on technical operations.

Wait for the next major incident to prove the value of security.

Immediately hire more security staff to demonstrate the importance of the function.

Request a reporting line change to the CEO and establish regular briefings with the board.

Which action best demonstrates a CISO aligning security initiatives with business strategy?

Focusing exclusively on compliance requirements to avoid legal penalties

Prioritizing security projects based on the organization's risk appetite and strategic objectives

Implementing the latest security technologies without consulting business units

Delegating all security decisions to the IT department to save time

Why does the CISO need to liaise with legal counsel?

To avoid any responsibility for compliance decisions

To have legal counsel make all security policy decisions

To understand legal requirements and ensure security practices align with them

To ensure security policies are kept confidential from regulators

What is a key responsibility of the CISO in security governance?

Performing daily system backups for all servers

Writing code for security software

Establishing and overseeing the security policy framework and compliance structures

Managing the organization's marketing campaigns

EC-CouncilCertified Chief Information Security Officer

Domain 3Objective 1

The Role of the CISO CCISO Practice Questions (Page 7)

Part of the Security Program Management and Operations domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

12concepts

Questions 31–35

31application · medium
During a major data breach, a company's CISO is coordinating the incident response. The CEO wants to issue a public statement immediately, but legal counsel advises waiting until the investigation confirms the scope. What should the CISO do?
Select an answer first
32application · medium
A newly appointed CISO at a mid-sized company discovers that the security team reports to the IT director and has no direct access to the CEO or board. The CISO wants to elevate the security function's strategic influence. What should the CISO do first?
Select an answer first
33foundation · easy
Which action best demonstrates a CISO aligning security initiatives with business strategy?
Select an answer first
34foundation · easy
Why does the CISO need to liaise with legal counsel?
Select an answer first
35foundation · easy
What is a key responsibility of the CISO in security governance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.