CCISO Financial Management 5

Question 1

A CISO is implementing a chargeback model where security costs are allocated back to business units. What is the primary governance benefit of this approach?

Accepted Answer

It creates business unit accountability for security spending and incentivizes risk-reducing behavior

Answer

Chargeback models make business units financially accountable for security costs, creating incentives to reduce risky behaviors that drive security spending.

Question 2

During a merger, a CISO is asked to value the cybersecurity risks of the acquisition target. Which financial due diligence activity is most critical?

Accepted Answer

Assessing undisclosed breach history, regulatory violations, and known vulnerability exposure

Answer

M&A security due diligence must prioritize undisclosed incidents, regulatory violations, and known vulnerabilities because these create inherited financial liabilities post-acquisition.

Question 3

A CISO is reviewing the organization's cyber insurance policy and finds that the policy excludes nation-state attacks. What type of exclusion is this?

Accepted Answer

War and hostile act exclusion

Answer

Nation-state attack exclusions fall under war and hostile act clauses, which insurers invoke to limit exposure to large-scale geopolitical cyber conflicts.

Question 4

A CISO wants to implement continuous security spending optimization. Which practice best supports real-time financial management of the security program?

Accepted Answer

Monthly budget vs. actuals reviews with rolling 90-day forecasts

Answer

Monthly actuals reviews with rolling forecasts enable CISOs to detect overspending or underspending early and reallocate funds before fiscal year-end constraints become binding.

Question 5

An organization experiences a ransomware attack with a demanded payment of $3M. The CISO must advise the CFO on the financial decision framework. Which factor most directly affects the pay-or-don't-pay decision?

Accepted Answer

The cost of alternative recovery options compared to ransom payment and regulatory risk of paying

Answer

The rational financial framework compares total cost of paying (ransom + regulatory sanctions risk + reputation) versus total cost of recovery (restoration time, data recreation, downtime losses).

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Financial Management 5