CCISO Governance, Risk & Compliance 4

Question 1

Which security governance structure places the CISO directly under the CEO, independent of IT?

Accepted Answer

Business-aligned CISO model

Answer

The business-aligned CISO model positions the CISO as a peer of the CIO, reporting to the CEO, ensuring security independence from IT operations.

Question 2

An Annual Loss Expectancy (ALE) is calculated as:

Accepted Answer

Single Loss Expectancy × Annualized Rate of Occurrence

Answer

ALE = SLE × ARO, where Single Loss Expectancy is the monetary loss per incident and Annualized Rate of Occurrence is how often it happens per year.

Question 3

Which NIST publication provides a framework specifically designed for improving critical infrastructure cybersecurity?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The NIST Cybersecurity Framework (CSF) was developed to help critical infrastructure organizations manage and reduce cybersecurity risk using Identify, Protect, Detect, Respond, and Recover functions.

Question 4

What is the primary goal of segregation of duties (SoD) as a governance control?

Accepted Answer

Prevent any single individual from having enough access to commit and conceal fraud

Answer

SoD ensures that critical business functions require multiple people, so no single individual can both execute and hide a fraudulent or malicious act.

Question 5

Which compliance framework is MOST relevant for organizations handling payment card data?

Accepted Answer

PCI DSS

Answer

PCI DSS (Payment Card Industry Data Security Standard) is the mandatory standard for all entities that store, process, or transmit cardholder data.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Governance, Risk & Compliance 4