A newly appointed CISO at a mid-sized financial firm is asked by the CEO to 'fix the security problem' by deploying a next-generation firewall and endpoint detection tools. The CISO reviews the current security posture and finds that the company has no formal risk assessment process, no security metrics, and that business units make independent security decisions. What should the CISO do FIRST to align security with business goals?

Hire additional security staff to handle the increased workload from the new tools.

Develop a security strategy that links security initiatives to business objectives and present it to the CEO and board for approval.

Conduct a penetration test to identify vulnerabilities and then report the findings to the board.

Immediately purchase and deploy the recommended firewall and EDR tools to address the CEO's request.

What is the CISO's role in security operations?

To direct and oversee the daily security operations and incident response activities

To personally monitor every security alert 24/7

To focus only on long-term strategy and ignore daily operations

To delegate all security operations to external vendors without oversight

To whom does the Chief Information Security Officer (CISO) most commonly report in a typical corporate structure?

The Chief Financial Officer (CFO)

The Chief Information Officer (CIO)

The Chief Marketing Officer (CMO)

The Chief Executive Officer (CEO) or Board of Directors

A CISO is planning the security budget for the next year. The company is expanding into a new market and will hire many new employees. The CISO must ensure the security program scales with the growth. Which budget item should be prioritized?

Increased marketing for the security team's internal brand.

A larger budget for executive travel.

A one-time purchase of a high-end security appliance.

Additional security awareness training for new hires and scalable security tooling.

A regional bank's CISO is preparing the annual security budget. The board has approved a modest increase but wants to see a direct link between security spending and the bank's strategic goal of expanding digital lending. Which approach best aligns the security budget with the business strategy?

Spend the increase on additional security staff and describe it as improving overall headcount ratios.

Fund a security assessment of the digital lending platform and a fraud-detection integration, then present the budget as enabling the new business line.

Allocate the increase to a new SIEM platform and present it as a modernization of security operations.

Request the same budget as last year with an inflation adjustment, arguing that security needs are stable.

EC-CouncilCertified Chief Information Security Officer

Domain 3Objective 1

The Role of the CISO CCISO Practice Questions (Page 8)

Part of the Security Program Management and Operations domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

12concepts

Questions 36–40

36application · medium
A newly appointed CISO at a mid-sized financial firm is asked by the CEO to 'fix the security problem' by deploying a next-generation firewall and endpoint detection tools. The CISO reviews the current security posture and finds that the company has no formal risk assessment process, no security metrics, and that business units make independent security decisions. What should the CISO do FIRST to align security with business goals?
Select an answer first
37foundation · easy
What is the CISO's role in security operations?
Select an answer first
38foundation · easy
To whom does the Chief Information Security Officer (CISO) most commonly report in a typical corporate structure?
Select an answer first
39application · medium
A CISO is planning the security budget for the next year. The company is expanding into a new market and will hire many new employees. The CISO must ensure the security program scales with the growth. Which budget item should be prioritized?
Select an answer first
40application · medium
A regional bank's CISO is preparing the annual security budget. The board has approved a modest increase but wants to see a direct link between security spending and the bank's strategic goal of expanding digital lending. Which approach best aligns the security budget with the business strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.