CCISO Financial Management 3

Question 1

A CISO identifies that a critical vendor managing customer PII has no cyber insurance. Under a shared risk model, what financial control should the CISO recommend?

Accepted Answer

Require the vendor to obtain adequate cyber liability insurance as a contractual obligation

Answer

Requiring vendors to maintain cyber liability insurance transfers financial risk back to the vendor and is a standard third-party risk management contractual control.

Question 2

A CISO must present a business case for a $2M security platform. The expected annual loss (ALE) for the risk it mitigates is $800,000. What does this indicate about the investment?

Accepted Answer

The investment cost exceeds the annual expected loss, suggesting it may not be cost-effective

Answer

When control cost ($2M) exceeds the annual expected loss ($800K), a cost-benefit analysis suggests the investment is not economically justified on risk grounds alone without other factors.

Question 3

Which of the following best describes the relationship between Annual Rate of Occurrence (ARO) and Annual Loss Expectancy (ALE)?

Accepted Answer

ALE = SLE × ARO

Answer

ALE is calculated by multiplying Single Loss Expectancy (the cost of one incident) by the Annual Rate of Occurrence (how often it is expected to occur per year).

Question 4

A CISO is asked to reduce the security budget by 20% mid-year. What is the most appropriate first step?

Accepted Answer

Perform a risk impact assessment to identify which cuts introduce the least additional risk

Answer

Before making cuts, a risk impact assessment identifies which expenditures are critical to risk posture versus optional, enabling informed decisions that minimize exposure.

Question 5

A publicly traded company's CISO must ensure that material cybersecurity incidents are disclosed per SEC rules. What is the primary financial risk of late or inaccurate disclosure?

Accepted Answer

SEC enforcement actions, fines, and shareholder litigation

Answer

Under SEC cybersecurity disclosure rules, late or inaccurate material incident reporting exposes the company to SEC enforcement, civil penalties, and securities fraud litigation.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Financial Management 3