CCISO Information Security & Risk Management 4

Question 1

A CISO is establishing a security governance structure. Which of the following BEST defines the role of a security steering committee?

Accepted Answer

To provide cross-functional oversight and strategic direction for the security program

Answer

A security steering committee provides executive-level, cross-functional governance by aligning security strategy with business objectives and approving major security program decisions.

Question 2

When applying FAIR (Factor Analysis of Information Risk), the term 'Loss Event Frequency' refers to:

Accepted Answer

How often a loss event is expected to occur within a defined timeframe

Answer

In the FAIR model, Loss Event Frequency measures how often loss events are expected to occur in a given period, combining threat event frequency and vulnerability.

Question 3

An organization's risk appetite statement should PRIMARILY be defined by:

Accepted Answer

The board of directors or executive leadership aligned with business strategy

Answer

Risk appetite reflects the organization's willingness to accept risk in pursuit of business objectives and must be set by the board or executive leadership to align with strategic direction.

Question 4

Which security control category BEST describes a business continuity plan?

Accepted Answer

Corrective control

Answer

A business continuity plan is a corrective control because it is designed to restore operations and recover from a disruptive event after it has occurred.

Question 5

A CISO is reviewing third-party risk. Which contractual mechanism BEST ensures the vendor maintains adequate security controls over time?

Accepted Answer

Right-to-audit clause in the service agreement

Answer

A right-to-audit clause gives the organization the contractual right to assess the vendor's security controls periodically, ensuring ongoing compliance with security requirements.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Information Security & Risk Management 4