EC-Council Certified CISO (CCISO v3) Questions and Answers
When dealing with Security Incident Response procedures, which of the following steps come FIRST when reacting to an incident?
How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?
An IT auditor has recently discovered that because of a shortage of skilled operations personnel, the security administrator has agreed to work one late night shift a week as the senior computer operator. The most appropriate course of action for the IT auditor is to:
While Cost Benefit Analysis (CBA) is the easiest calculation among financial tools, what is its main weakness?
What is protected by Federal Information Processing Standards (FIPS) 140-2?
Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?
From an information security perspective, information that no longer supports the main purpose of the business should be:
The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:
A missing/ineffective security control is identified. Which of the following should be the NEXT step?
Risk that remains after risk mitigation is known as
A global retail organization is looking to implement a consistent Disaster Recovery and Business Continuity Process across all of its business units. Which of the following standards and guidelines can BEST address this organization’s need?
A security team member calls you to inform you that one of your databases might have been compromised, but there are no details available. As the security leader, what should you do?
When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?
Which of the following are MOST often included in the security strategy?
An organization information security policy serves to
What process evaluates technical and non-technical security controls to validate that an implementation meets a specific set of security requirements?
The process of identifying and classifying assets is typically included in the
The network administrator wants to strengthen physical security in the organization. Specifically, to implement a
solution stopping people from entering certain restricted zones without proper credentials. Which of following
physical security measures should the administrator use?
Which of the following best represents a calculation for Annual Loss Expectancy (ALE)?
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
The CISO has validated audit findings, determined if compensating controls exist, and started initial remediation planning. Which of the following is the MOST logical next step?
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
The organization has already been subject to a significant amount of credit card fraud. Which of the following is the MOST likely reason for this fraud?
When would it be more desirable to develop a set of decentralized security policies and procedures within an enterprise environment?
Which of the following has the GREATEST impact on the implementation of an information security governance model?
Devising controls for information security is a balance between?
What type of control is used when patching systems with the latest updates?
Which of the following has the PRIMARY responsibility for determining access rights requirements to information?
Scenario: You are the CISO and are required to brief the C-level executive team on your information security audit for the year. During your review of the audit findings you discover that many of the controls that were put in place the previous year to correct some of the findings are not performing as needed. You have thirty days until the briefing.
To formulate a remediation plan for the non-performing controls what other document do you need to review before adjusting the controls?
After a risk assessment is performed, a particular risk is considered to have the potential of costing the organization 1.2 Million USD. This is an example of
As a CISO you need to understand the steps that are used to perform an attack against a network. Put each step into the correct order.
1.Covering tracks
2.Scanning and enumeration
3.Maintaining Access
4.Reconnaissance
5.Gaining Access
In which of the following cases would an organization be more prone to risk acceptance vs. risk mitigation?
Which regulation or policy governs protection of personally identifiable user data gathered during a cyber investigation?
Which of the following is critical in creating a security program aligned with an organization’s goals?
A CISO must conduct risk assessments using a method where the Chief Financial Officer (CFO) receives impact data in financial terms to use as input to select the proper level of coverage in a new cybersecurity insurance policy.
What is the MOST effective method of risk analysis to provide the CFO with the information required?
Which risk analysis method is the MOST effective for determining the exact financial impact of risks in an organization?
When considering using a vendor to help support your security devices remotely, what is the BEST choice for allowing access?
The general ledger setup function in an enterprise resource package allows for setting accounting periods. Access to this function has been permitted to users in finance, the shipping department, and production scheduling. What is the most likely reason for such broad access?
Which of the following is the BEST solution to monitor, measure, and report changes to critical data in a system or repository?
Which of the following statements below regarding Key Performance indicators (KPIs) are true?
Which level of data destruction applies logical techniques to sanitize data in all user-addressable storage locations?
In the event of a cybersecurity breach within a publicly traded company, who bears the ultimate responsibility to the shareholders?
A CISO has implemented a risk management capability within the security portfolio. Which of the following
terms best describes this functionality?
During an initial investigation, the Incident Response Team suspects criminal activity but cannot initially prove or disprove illegal actions. What is the MOST critical action they should take?
When analyzing and forecasting a capital expense budget what are not included?
Scenario: Most industries require compliance with multiple government regulations and/or industry standards to meet data protection and privacy mandates.
When multiple regulations or standards apply to your industry you should set controls to meet the:
What is a Statement of Objectives (SOA)?
What is the last step in the system authorization process?
What role does the statement of retained earnings serve within the financial reporting of an organization?
When updating the security strategic planning document what two items must be included?
An organization correctly configured a Data Loss Prevention (DLP) technology. Afterward, sensitive data was found on public websites. What is the MOST likely reason for this situation?
When you develop your audit remediation plan what is the MOST important criteria?
What does the information security program primarily protect?
Why would you follow a formal risk management process in an organization that requires the use of Personally Identifiable Information (PII) as part of the business model?
An organization's Information Security Policy is of MOST importance because
Which of the following provides an audit framework?
According to ISO 27001, of the steps for establishing an Information Security Governance program listed below, which comes first?
What role should the CISO play in properly scoping a PCI environment?
A recent audit has identified a few control exceptions and is recommending the implementation of technology and processes to address the finding. Which of the following is the MOST likely reason for the organization to reject the implementation of the recommended technology and processes?
A company wants to fill a Chief Information Security Officer position in the organization. They need to define and implement a more holistic security program. Which of the following qualifications and experience would be MOST desirable to find in a candidate?
Which of the following is considered one of the most frequent failures in project management?
In what phase of an incident management process will malware antivirus signatures be distributed to infrastructure?
Which of the following terms is used to describe countermeasures implemented to minimize risks to physical
property, information, and computing systems?
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how
hardware and software is implemented and managed within the organization. Which of the following principles
does this best demonstrate?
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
In what phase of the response will the team extract information from the affected systems without altering original data?
Which of the following is the MOST important goal of risk management?
What should an auditor do after discovering that a security analyst is working a late-night shift every week as the senior server administrator?
Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Which of the following industry / sector neutral information security control frameworks should you recommend for implementation?
Step-by-step procedures to regain normalcy in the event of a major earthquake is PRIMARILY covered by which of the following plans?
When selecting a security solution with reoccurring maintenance costs after the first year, the CISO should: (choose the BEST answer)
Annual Loss Expectancy is derived from the function of which two factors?
Which type of scan is used on the eye to measure the layer of blood vessels?
While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?
Which represents PROPER separation of duties in the corporate environment?
The effectiveness of social engineering penetration testing using phishing can be used as a Key Performance Indicator (KPI) for the effectiveness of an organization’s
Which of the following is of MOST importance when security leaders of an organization are required to align security to influence the culture of an organization?
Effective information security management programs require the active involvement of_________
The patching and monitoring of systems on a consistent schedule is required by?
What is a key policy that should be part of the information security plan?
In MOST organizations which group periodically reviews network intrusion detection system logs for all systems as part of their daily tasks?
How is an Annual Loss Expectancy (ALE) calculated?
SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.
The CISO is unsure of the information provided and orders a vendor proof of concept to validate the system’s scalability. This demonstrates which of the following?
Who should be involved in the development of an internal campaign to address email phishing?
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
Which of the following would be the FIRST step when addressing Information Security formally and consistently in this organization?
An example of professional unethical behavior is:
Which of the following is a symmetric encryption algorithm?
Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?
Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?
Which of the following is a primary method of applying consistent configurations to IT systems?
You are the Chief Information Security Officer of a large, multinational bank and you suspect there is a flaw in a two factor authentication token management process. Which of the following represents your BEST course of action?
XYZ is a publicly-traded software development company.
Who is ultimately accountable to the shareholders in the event of a cybersecurity breach?
Which of the following illustrates an operational control process:
Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget.
Which of the following will be most helpful for getting an Information Security project that is behind schedule back on schedule?
An ineffective security control was identified during an audit. What is the next action that should happen?
What is the PRIMARY guideline when analyzing the cost of a security control versus the cost of the asset?
Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the “real workers.”
Which group of people should be consulted when developing your security program?
When analyzing and forecasting an operating expense budget what are not included?
What are the three stages of an identity and access management system?
A large number of accounts in a hardened system were suddenly compromised to an external party. Which of
the following is the MOST probable threat actor involved in this incident?
Which of the following is a PRIMARY task of a risk management function within the security program?
Where does bottom-up financial planning primarily gain information for creating budgets?
You are the CISO of a commercial social media organization. The leadership wants to rapidly create new methods of sharing customer data through creative linkages with mobile devices. You have voiced concern about privacy regulations but the velocity of the business is given priority. Which of the following BEST describes this organization?
What is the BEST practice for having vendors verify controls within their services or products to protect customer data and systems?
A system is designed to dynamically block offending Internet IP-addresses from requesting services from a secure website. This type of control is considered
What is the first action taken when reacting to a malware attack?
Acceptable levels of information security risk tolerance in an organization should be determined by?
Enforcing the implementation and management of security controls within services or products offered by third-party providers is a vital component of which security program service to the business?
Which of the following are necessary to formulate responses to external audit findings?
Which of the following is the BEST reason for having a formal Request for Proposal (RFP) process?
What organizational structure combines the functional and project structures to create a hybrid of the two?
What should an organization do to ensure that they have an effective Business Continuity Plan?
Ciphertext is encrypted with the same key used by the recipient to decrypt it. What encryption method is being used?
What is the estimate of all direct and indirect costs associated with an asset or acquisition over its entire life cycle?
When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?
Scenario: Your corporate systems have been under constant probing and attack from foreign IP addresses for more than a week. Your security team and security infrastructure have performed well under the stress. You are confident that your defenses have held up under the test, but rumors are spreading that sensitive customer data has been stolen and is now being sold on the Internet by criminal elements. During your investigation of the rumored compromise you discover that data has been breached and you have discovered the repository of stolen data on a server located in a foreign country. Your team now has full access to the data on the foreign server.
Your defenses did not hold up to the test as originally thought. As you investigate how the data was compromised through log analysis you discover that a hardworking, but misguided business intelligence analyst posted the data to an obfuscated URL on a popular cloud storage service so they could work on it from home during their off-time. Which technology or solution could you deploy to prevent employees from removing corporate data from your network? Choose the BEST answer.
The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted. Soon, the help desk is flooded with complaints about the slow performance of the laptops and users are upset. What did the CISO do wrong? (choose the BEST answer):
What is the first thing that needs to be completed in order to create a security program for your organization?
Which of the following defines the boundaries and scope of a risk assessment?
What two methods are used to assess risk impact?
A key cybersecurity feature of a Personal Identification Verification (PIV) Card is:
Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget.
Using the best business practices for project management, you determine that the project correctly aligns with the organization goals. What should be verified next?
Your IT auditor is reviewing significant events from the previous year and has identified some procedural oversights. Which of the following would be the MOST concerning?
What term BEST describes assuring the actions of employees, applications, and systems follow the organization's rules and regulations?
When managing the critical path of an IT security project, which of the following is MOST important?
What principle is used when a CISO evaluates controls to ensure they satisfy the organization’s operational needs?
One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient. Which of the following keys should be used to encrypt the message?
How often should an environment be monitored for cyber threats, risks, and exposures?
You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.
Using the best business practices for project management you determine that the project correctly aligns with the company goals and the scope of the project is correct. What is the NEXT step?
When developing the Business Impact Assessment (BIA), which of the following MOST closely relates to data backup and restoration?
Which of the following is the PRIMARY goal of information security?
Security related breaches are assessed and contained through which of the following?
Which of the following most commonly falls within the scope of an information security governance steering committee?
The ability to hold intruders accountable in a court of law is important. Which of the following activities are needed to ensure the highest possibility for successful prosecution?
Which security technologies are MOST critical to implementing a zero trust model?
Which type of physical security control scan a person’s external features through a digital video camera before
granting access to a restricted area?
A business unit within your organization intends to deploy a new technology in a manner that places it in violation of existing information security standards. What immediate action should the information security manager take?
A method to transfer risk is to:
An international organization is planning a project to implement encryption technologies to protect company confidential information. This organization has data centers on three continents. Which of the following would be considered a MAJOR constraint for the project?
Quantitative Risk Assessments have the following advantages over qualitative risk assessments:
The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?
Which of the following intellectual Property components is focused on maintaining brand recognition?
You manage a newly created Security Operations Center (SOC), your team is being inundated with security alerts and don’t know what to do. What is the BEST approach to handle this situation?
Which of the following functions evaluates patches used to close software vulnerabilities of new systems to assure compliance with policy when implementing an information security program?
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how hardware and software is implemented and managed within the organization. Which of the following principles does this best demonstrate?
What will a CISO analyze if she wants to understand the MOST current financial status of the organization?
Providing oversight of a comprehensive information security program for the entire organization is the primary responsibility of which group under the InfoSec governance framework?
The company decides to release the application without remediating the high-risk vulnerabilities. Which of the following is the MOST likely reason for the company to release the application?
Which of the following is the MOST logical method of deploying security controls within an organization?
What is the primary reason for performing vendor management?
What is the MOST effective approach to gaining business unit approval of security controls within an organization?
Creating a secondary authentication process for network access would be an example of?
As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader. What should you do?
You are the CISO for an investment banking firm. The firm is using artificial intelligence (AI) to assist in approving clients for loans.
Which control is MOST important to protect AI products?
The governing body that defines best practices for the collection of digital evidence is the:
What process defines the framework of rules and practices by which a board of directors ensure accountability, fairness and transparency in an organization's relationship with its shareholders?
Which of the following is the BEST choice of security metrics to present to a Board of Directors?
Human resource planning for security professionals in your organization is a:
Which of the following functions evaluates risk present in IT initiatives and/or systems when implementing an information security program?
Developing effective security controls is a balance between which of the following?
When reviewing a Solution as a Service (SaaS) provider’s security health and posture, which key document should you review?
Which of the following is a benefit of information security governance?
A university recently hired a CISO. One of the first tasks is to develop a continuity of operations plan (COOP).
In developing the business impact assessment (BIA), which of the following MOST closely relate to the data backup and restoral?
Who in the organization determines access to information?
What oversight should the information security team have in the change management process for application security?
Scenario: Your company has many encrypted telecommunications links for their world-wide operations. Physically distributing symmetric keys to all locations has proven to be administratively burdensome, but symmetric keys are preferred to other alternatives.
How can you reduce the administrative burden of distributing symmetric keys for your employer?
A stakeholder is a person or group:
Which of the following best describes revenue?
The exposure factor of a threat to your organization is defined by?
Which of the following would negatively impact a log analysis of a multinational organization?
What is an example of a key performance indicator for cybersecurity?
The Annualized Loss Expectancy (Before) minus Annualized Loss Expectancy (After) minus Annual Safeguard Cost is the formula for determining:
You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.
Using the best business practices for project management you determine that the project correct aligns with the company goals. What needs to be verified FIRST?
Which of the following is the MOST effective technology to counter phishing attacks?
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
What type of control is being implemented by supervisors and data owners?
If your organization operates under a model of "assumption of breach", you should:
Alerting, monitoring, and managing security-related events is typically performed by what security function?
The newly appointed CISO of an organization is reviewing the IT security strategic plan. Which of the following is the MOST important component of the strategic plan?
Which of the following is the MOST effective method for discovering common technical vulnerabilities within the
IT environment?
Which of the following best describes a portfolio?
What is the purpose of International Organization for Standardization (ISO) 27002?
Which of the following is the BEST method to manage data that no longer provides business value?
An application vulnerability assessment has identified a security flaw in an application. This is a flaw that was previously identified and remediated on a prior release of the application. Which of the following is MOST likely the reason for this recurring issue?
What are the common data hiding techniques used by criminals?
Which of the following are NOT within the responsibilities of a CISO?
Which of the following represents the BEST reason for an organization to use the Control Objectives for Information and Related Technology (COBIT) as an Information Technology (IT) framework?
What type of attack requires the least amount of technical equipment and has the highest success rate?
Physical security measures typically include which of the following components?
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
When adjusting the controls to mitigate the risks, how often should the CISO perform an audit to verify the controls?
Which of the following illustrates an operational control?
Which of the following reports should you as an IT auditor use to check on compliance with a service level agreement’s requirement for uptime?
Risk transference is BEST represented by which of the following actions?
Physical security measures typically include which of the following types of controls?
Which of the following is an IT governance framework that allows managers to bridge the gap between control requirements, technical issues, and business risks?
