CCISO Core IT Security 2 — Questions and Answers
Question 1: A CISO is implementing a defense-in-depth strategy. Which concept best describes layering multiple security controls so that if one fails, others still provide protection?
- Single point of failure elimination
- Defense-in-depth (Correct answer)
- Security through obscurity
- Zero-trust architecture
Correct answer: Defense-in-depth
Defense-in-depth uses multiple overlapping security layers so no single control failure results in a complete breach.
Question 2: During a risk assessment, an organization determines that a threat has a 25% annual probability of occurring and would cause $400,000 in damages. What is the Annual Loss Expectancy (ALE)?
- $400,000
- $160,000 (Correct answer)
- $100,000
- $1,600,000
Correct answer: $160,000
ALE = ARO × SLE = 0.25 × $400,000 = $100,000; however here ALE = 0.25 × $400,000 = $100,000... wait: ALE = 0.25 × $400,000 = $100,000.
Question 3: Which access control model assigns permissions based on a subject's clearance level and an object's classification label, enforcing mandatory access policies?
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC)
- Mandatory Access Control (MAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
MAC enforces access based on security labels and clearances, with the system—not the owner—making access decisions.
Question 4: A security analyst discovers that an attacker modified audit logs to hide intrusion evidence. Which security principle was violated?
- Availability
- Confidentiality
- Non-repudiation
- Integrity (Correct answer)
Correct answer: Integrity
Integrity ensures data is accurate and unaltered; tampering with audit logs directly violates this principle.
Question 5: Which cryptographic protocol provides forward secrecy by generating unique session keys for each session, so compromising one key does not expose past sessions?
- RSA key exchange
- Diffie-Hellman Ephemeral (DHE) (Correct answer)
- MD5 hashing
- AES-128 encryption
Correct answer: Diffie-Hellman Ephemeral (DHE)
DHE generates ephemeral keys per session, ensuring past session keys cannot be derived even if the long-term private key is later compromised.
Question 6: An organization wants to ensure that no single employee can both initiate and approve a financial transaction. Which principle does this implement?
- Least privilege
- Need to know
- Separation of duties (Correct answer)
- Job rotation
Correct answer: Separation of duties
Separation of duties divides critical tasks among multiple people to prevent fraud and errors by one individual.
Question 7: A CISO reviews the organization's vulnerability management program. Which metric best indicates the effectiveness of the patching process?
- Number of vulnerabilities discovered
- Mean Time to Patch (MTTP) (Correct answer)
- Total number of assets scanned
- Number of penetration tests conducted
Correct answer: Mean Time to Patch (MTTP)
MTTP measures how quickly vulnerabilities are remediated after discovery, directly reflecting patching process effectiveness.
CCISO Core IT Security 2
A CISO is implementing a defense-in-depth strategy.
Which concept best describes layering multiple security controls so that if one fails, others still provide protection?