CCISO Financial Management 2

Question 1

A CISO needs to justify a $500,000 security investment to the board. Which financial metric best demonstrates the investment's value by comparing potential loss reduction to cost?

Accepted Answer

Return on Security Investment (ROSI)

Answer

ROSI specifically quantifies security investment value by calculating how much risk (potential loss) is reduced relative to the cost of the control.

Question 2

During budget planning, a CISO discovers that the organization's cyber insurance premium is increasing 40% due to poor security posture. How should this be classified in the security budget?

Accepted Answer

Operational expenditure (OpEx)

Answer

Insurance premiums are recurring operational costs classified as OpEx, not one-time capital investments.

Question 3

A CISO is building a Total Cost of Ownership (TCO) model for a new SIEM platform. Which component is most commonly underestimated in TCO calculations?

Accepted Answer

Integration, training, and ongoing maintenance costs

Answer

TCO models often underestimate indirect costs like staff training, system integration labor, and ongoing maintenance, which frequently exceed initial procurement costs.

Question 4

A company allocates its security budget using a percentage of IT budget model. What is the primary weakness of this approach compared to risk-based budgeting?

Accepted Answer

It fails to account for the organization's specific threat landscape and risk profile

Answer

Percentage-of-IT budgeting is a benchmarking shortcut that ignores the organization's unique risks, industry threats, and regulatory requirements.

Question 5

When presenting a security budget variance to the CFO, the CISO notes spending exceeded the incident response line item by 200% due to a ransomware event. How should this be categorized?

Accepted Answer

Unfavorable variance requiring reforecast

Answer

Unplanned cost overruns driven by security incidents represent unfavorable variances that require budget reforecast and updated financial planning.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Financial Management 2