A CISO at a software company is reviewing a new contract with a cloud service provider that will host customer data. The contract includes a clause that limits the provider's liability for data breaches. The CISO is concerned about the organization's legal exposure. What should the CISO do?

Refuse to sign the contract and recommend building an in-house data center instead.

Accept the contract as-is because the provider is a major cloud vendor with strong security.

Consult with legal counsel to assess the clause and negotiate for more favorable liability terms or additional protections.

Require the provider to obtain cyber insurance to cover any potential losses.

A company's CISO is reviewing a contract with a new cloud provider. The provider's standard terms limit liability for data breaches and do not guarantee data deletion after contract termination. The company handles sensitive personal data. What should the CISO do?

Rely on the provider's certifications as sufficient assurance.

Accept the terms because the provider is well-known.

Negotiate contractual terms that include adequate liability provisions and data deletion commitments.

Sign the contract as-is to avoid delaying the cloud migration.

What is the primary purpose of aligning security initiatives with business goals and objectives?

To reduce the number of security policies to simplify compliance

To ensure that security investments directly support the organization's mission and strategic direction

To maximize the security budget regardless of business needs

To isolate security decisions from business strategy to avoid interference

A company's CISO is leading the enterprise risk management process. A critical third-party supplier has a known vulnerability that could expose customer data, but replacing the supplier would disrupt operations for months. The CISO must decide how to handle this risk. What is the most appropriate approach?

Accept the risk without any action because the supplier is critical.

Transfer the risk by purchasing cyber insurance and take no other action.

Immediately terminate the supplier contract to eliminate the risk.

Work with the supplier to implement compensating controls and monitor the risk, while developing a contingency plan.

Which of the following is an example of a security governance activity?

Installing antivirus software on employee laptops

Reviewing and updating the organization's information security policies annually

Responding to a phishing email incident

EC-CouncilCertified Chief Information Security Officer

Domain 3Objective 1

The Role of the CISO CCISO Practice Questions (Page 9)

Part of the Security Program Management and Operations domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

12concepts

Questions 41–45

41application · medium
A CISO at a software company is reviewing a new contract with a cloud service provider that will host customer data. The contract includes a clause that limits the provider's liability for data breaches. The CISO is concerned about the organization's legal exposure. What should the CISO do?
Select an answer first
42expert · hard
A company's CISO is reviewing a contract with a new cloud provider. The provider's standard terms limit liability for data breaches and do not guarantee data deletion after contract termination. The company handles sensitive personal data. What should the CISO do?
Select an answer first
43foundation · easy
What is the primary purpose of aligning security initiatives with business goals and objectives?
Select an answer first
44expert · hard
A company's CISO is leading the enterprise risk management process. A critical third-party supplier has a known vulnerability that could expose customer data, but replacing the supplier would disrupt operations for months. The CISO must decide how to handle this risk. What is the most appropriate approach?
Select an answer first
45foundation · easy
Which of the following is an example of a security governance activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.