CCISO Information Security & Risk Management 3

Question 1

A CISO must present the security program's value to the board. Which metric BEST demonstrates the effectiveness of security controls from a business risk perspective?

Accepted Answer

Reduction in risk exposure measured in dollar value

Answer

Boards understand financial risk; expressing risk reduction in dollar value directly connects security investments to business outcomes they can evaluate.

Question 2

Under ISO/IEC 27005, the risk evaluation step is performed to:

Accepted Answer

Compare risk analysis results against risk criteria to prioritize treatment

Answer

Risk evaluation compares the estimated risk levels against pre-established risk criteria to determine which risks require treatment and their priority.

Question 3

Which of the following BEST represents a Key Risk Indicator (KRI) for an information security program?

Accepted Answer

Percentage of critical systems with unpatched vulnerabilities older than 90 days

Answer

A KRI measures leading indicators of potential risk exposure; unpatched critical systems represent a measurable condition that predicts future breach likelihood.

Question 4

An organization wants to ensure its information security risk management aligns with enterprise risk management (ERM). The PRIMARY benefit of this alignment is:

Accepted Answer

Ensuring security risks are considered alongside strategic and operational risks

Answer

Aligning information security risk management with ERM ensures that cyber risks are viewed in the context of overall business risk, enabling better prioritization and resource allocation.

Question 5

Which statement BEST describes the purpose of a Statement of Applicability (SoA) in an ISO 27001 implementation?

Accepted Answer

It documents which Annex A controls are applicable and why others are excluded

Answer

The SoA is a required ISO 27001 document that identifies which Annex A controls are applicable, justifies their inclusion, and explains why excluded controls are not relevant.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Information Security & Risk Management 3