EC-Council Certified CISO (CCISO) Questions and Answers
Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?
Which of the following is used to lure attackers into false environments so they can be monitored, contained, or blocked from reaching critical systems?
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how
hardware and software is implemented and managed within the organization. Which of the following principles
does this best demonstrate?
Bob waits near a secured door, holding a box. He waits until an employee walks up to the secured door and
uses the special card in order to access the restricted area of the target company. Just as the employee opens
the door, Bob walks up to the employee (still holding the box) and asks the employee to hold the door open so
that he can enter. What is the best way to undermine the social engineering activity of tailgating?
Scenario: As you begin to develop the program for your organization, you assess the corporate culture and determine that there is a pervasive opinion that the security program only slows things down and limits the performance of the “real workers.”
What must you do first in order to shift the prevailing opinion and reshape corporate culture to understand the value of information security to the organization?
Which of the following best describes the sensors designed to project and detect a light beam across an area?
When creating contractual agreements and procurement processes why should security requirements be included?
Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation.
Your Corporate Information Security Policy should include which of the following?
The process to evaluate the technical and non-technical security controls of an IT system to validate that a given design and implementation meet a specific set of security requirements is called
Which of the following best describes a portfolio?
Scenario: You are the CISO and have just completed your first risk assessment for your organization. You find many risks with no security controls, and some risks with inadequate controls. You assign work to your staff to create or adjust existing security controls to ensure they are adequate for risk mitigation needs.
You have identified potential solutions for all of your risks that do not have security controls. What is the NEXT step?
A consultant is hired to do physical penetration testing at a large financial company. In the first day of his
assessment, the consultant goes to the company’s building dressed like an electrician and waits in the lobby for
an employee to pass through the main access gate, then the consultant follows the employee behind to get into
the restricted area. Which type of attack did the consultant perform?
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
Recently, members of your organization have been targeted through a number of sophisticated phishing attempts and have compromised their system credentials. What action can you take to prevent the misuse of compromised credentials to change bank account information from outside your organization while still allowing employees to manage their bank information?
Simon had all his systems administrators implement hardware and software firewalls to ensure network
security. They implemented IDS/IPS systems throughout the network to check for and stop any unauthorized
traffic that may attempt to enter. Although Simon and his administrators believed they were secure, a hacker
group was able to get into the network and modify files hosted on the company's website. After searching
through the firewall and server logs, no one could find how the attackers were able to get in. He decides that
the entire network needs to be monitored for critical and essential file changes. This monitoring tool alerts
administrators when a critical file is altered. What tool could Simon and his administrators implement to
accomplish this?
A CISO wants to change the defense strategy to ward off attackers. To accomplish this the CISO is looking to a strategy where attackers are lured into a zone of a safe network where attackers can be monitored, controlled, quarantined, or eradicated.
Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.
From an Information Security Leadership perspective, which of the following is a MAJOR concern about the CISO’s approach to security?
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
During initial investigation, the team suspects criminal activity but cannot initially prove or disprove illegal actions. What is the MOST critical aspect of the team’s activities?
SCENARIO: Critical servers show signs of erratic behavior within your organization’s intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
What phase of the response provides measures to reduce the likelihood of an incident from recurring?
Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget.
Using the best business practices for project management, you determine that the project correctly aligns with the organization goals. What should be verified next?
You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.
Using the best business practices for project management you determine that the project correct aligns with the company goals. What needs to be verified FIRST?
As the Business Continuity Coordinator of a financial services organization, you are responsible for ensuring assets are recovered timely in the event of a disaster. Which is the BEST Disaster Recovery performance indicator to validate that you are prepared for a disaster?
Which of the following provides an independent assessment of a vendor’s internal security controls and overall posture?
File Integrity Monitoring (FIM) is considered a
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
The organization has already been subject to a significant amount of credit card fraud. Which of the following is the MOST likely reason for this fraud?
What is meant by password aging?
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
After determining the audit findings are accurate, which of the following is the MOST logical next activity?
Which of the following is the MOST logical method of deploying security controls within an organization?
What are the three stages of an identity and access management system?
Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals
the increasing need to address security consistently at the enterprise level. This new CISO, while confident with
skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.
From an Information Security Leadership perspective, which of the following is a MAJOR concern about the
CISO’s approach to security?
Which type of physical security control scan a person’s external features through a digital video camera before
granting access to a restricted area?
The process of identifying and classifying assets is typically included in the
Which of the following is a symmetric encryption algorithm?
What is the FIRST step in developing the vulnerability management program?
What type of attack requires the least amount of technical equipment and has the highest success rate?
Which of the following is the MAIN security concern for public cloud computing?
Which of the following statements about Encapsulating Security Payload (ESP) is true?
Your penetration testing team installs an in-line hardware key logger onto one of your network machines. Which of the following is of major concern to the security organization?
Physical security measures typically include which of the following components?
SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:
An anonymity network is a series of?
Security related breaches are assessed and contained through which of the following?
One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient. Which of the following keys should be used to encrypt the message?
Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?
The process of creating a system which divides documents based on their security level to manage access to private data is known as
The process for identifying, collecting, and producing digital information in support of legal proceedings is called
Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network. Which is the single most important factor to introducing digital evidence into a court of law?
Your organization provides open guest wireless access with no captive portals. What can you do to assist with law enforcement investigations if one of your guests is suspected of committing an illegal act using your network?
Which wireless encryption technology makes use of temporal keys?
Which of the following backup sites takes the longest recovery time?
Which of the following is a countermeasure to prevent unauthorized database access from web applications?
An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?
A customer of a bank has placed a dispute on a payment for a credit card account. The banking system uses digital signatures to safeguard the integrity of their transactions. The bank claims that the system shows proof that the customer in fact made the payment. What is this system capability commonly known as?
You are having a penetration test done on your company network and the leader of the team says they discovered all the network devices because no one had changed the Simple Network Management Protocol (SNMP) community strings from the defaults. Which of the following is a default community string?
As a CISO you need to understand the steps that are used to perform an attack against a network. Put each step into the correct order.
1.Covering tracks
2.Scanning and enumeration
3.Maintaining Access
4.Reconnaissance
5.Gaining Access
The general ledger setup function in an enterprise resource package allows for setting accounting periods. Access to this function has been permitted to users in finance, the shipping department, and production scheduling. What is the most likely reason for such broad access?
Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?
While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?
The ability to hold intruders accountable in a court of law is important. Which of the following activities are needed to ensure the highest possibility for successful prosecution?
In terms of supporting a forensic investigation, it is now imperative that managers, first-responders, etc., accomplish the following actions to the computer under investigation:
What is the term describing the act of inspecting all real-time Internet traffic (i.e., packets) traversing a major Internet backbone without introducing any apparent latency?
The Health Insurance Portability and Accountability Act (HIPAA) requires an agreement between Cloud Service Providers (CCSP) and the covered entity. Based on HIPAA. which document must be completed between the covered entity and the CCSP?
Which of the following is the MOST effective method to counter phishing attacks?
Which of the following strategies provides the BEST response to a ransomware attack?
An auditor is reviewing the security classifications for a group of assets and finds that many of the assets are not correctly classified.
What should the auditor’s NEXT step be?
The primary responsibility for assigning entitlements to a network share lies with which role?
When performing a forensic investigation, what are the two MOST common data sources for obtaining evidence from a computer and mobile devices?
While Cost Benefit Analysis (CBA) is the easiest calculation among financial tools, what is its main weakness?
Which of the following is the MOST effective way to secure the physical hardware hosts in a virtualized environment?
Optical biometric recognition such as retina scanning provides access to facilities through reading the unique characteristics of a person’s eye.
However, authorization failures can occur with individuals who have?
What is an example of a key performance indicator for cybersecurity?
Many successful cyber-attacks currently include:
What is the MAIN responsibility of the purple security testing team?
What is the purpose of the statement of retained earnings of an organization?
Devising controls for information security is a balance between?
What are the four groups that are critical to the success of evaluating and approving contracts during the negotiation phase?
What Enterprise Architecture Framework is business-centric and is composed of eight phases?
The Board of Directors of a publicly-traded company is concerned about the security implications of a strategic project that will migrate 50% of the organization’s information technology assets to the cloud. They have requested a briefing on the project plan and a progress report of the security stream of the project. As the CISO, you have been tasked with preparing the report for the Chief Executive Officer to present.
Using the Earned Value Management (EVM), what does a Cost Variance (CV) of -1,200 mean?
The governing body that defines best practices for the collection of digital evidence is the:
During a cyber incident, which non-security personnel might be needed to assist the security team?
Effective information security management programs require the active involvement of_________
Which publication serves as a resource of enterprise security-based standards and BEST practices?
A Security Operations Manager is finding it difficult to maintain adequate staff levels to monitor security operations during off-hours. To reduce the impact of staff shortages and increase coverage during off-hours, the SecOps manager is considering outsourcing off-hour coverage.
What Security Operations Center (SOC) model does this BEST describe?
What is the primary difference between regulations and standards?
When developing the Business Impact Assessment (BIA), which of the following MOST closely relates to data backup and restoration?
What are the common data hiding techniques used by criminals?
Which security technologies are MOST critical to implementing a zero trust model?
An organization has decided to develop an in-house BCM capability. The organization has determined it is best to follow a BCM standard published by the International Organization for Standardization (ISO).
The BEST ISO standard to follow that outlines the complete lifecycle of BCM is?
To reduce the threat of spear phishing, which of the following is the MOST critical security control to implement?
Which of the following refers to the quantity or quality of project deliverables expanding from the original project plan?
A Security Operations (SecOps) Manager is considering implementing threat hunting to be able to make better decisions on protecting information and assets.
What is the MAIN goal of threat hunting to the SecOps Manager?
What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?
The framework that helps to define a minimum standard of protection that business stakeholders must attempt to achieve is referred to as a standard of:
An information security department is required to remediate system vulnerabilities when they are discovered. Please select the three primary remediation methods that can be used on an affected system.
Which of the following is the MAIN reason to follow a formal risk management process in an organization that hosts and uses privately identifiable information (PII) as part of their business models and processes?
As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader. What should you do?
Which International Organization for Standardization (ISO) below BEST describes the performance of risk management, and includes a five-stage risk management methodology.
The patching and monitoring of systems on a consistent schedule is required by?
Which of the following is MOST important when dealing with an Information Security Steering committee:
The executive board has requested that the CISO of an organization define and Key Performance Indicators (KPI) to measure the effectiveness of the security awareness program provided to call center employees. Which of the following can be used as a KPI?
Which of the following is a weakness of an asset or group of assets that can be exploited by one or more threats?
Risk is defined as:
Which of the following are the MOST important factors for proactively determining system vulnerabilities?
If your organization operates under a model of "assumption of breach", you should:
The implementation of anti-malware and anti-phishing controls on centralized email servers is an example of what type of security control?
Which of the following international standards can be BEST used to define a Risk Management process in an organization?
Ensuring that the actions of a set of people, applications and systems follow the organization’s rules is BEST described as:
What is the definition of Risk in Information Security?
You have purchased a new insurance policy as part of your risk strategy. Which of the following risk strategy options have you engaged in?
Which of the following activities results in change requests?
An organization licenses and uses personal information for business operations, and a server containing that information has been compromised. What kind of law would require notifying the owner or licensee of this incident?
A new CISO just started with a company and on the CISO's desk is the last complete Information Security Management audit report. The audit report is over two years old. After reading it, what should be the CISO's FIRST priority?
When a critical vulnerability has been discovered on production systems and needs to be fixed immediately, what is the BEST approach for a CISO to mitigate the vulnerability under tight budget constraints?
In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?
According to the National Institute of Standards and Technology (NIST) SP 800-40, which of the following considerations are MOST important when creating a vulnerability management program?
An organization has defined a set of standard security controls. This organization has also defined the circumstances and conditions in which they must be applied. What is the NEXT logical step in applying the controls in the organization?
Which of the following set of processes is considered to be one of the cornerstone cycles of the International Organization for Standardization (ISO) 27001 standard?
According to ISO 27001, of the steps for establishing an Information Security Governance program listed below, which comes first?
When choosing a risk mitigation method what is the MOST important factor?
A recent audit has identified a few control exceptions and is recommending the implementation of technology and processes to address the finding. Which of the following is the MOST likely reason for the organization to reject the implementation of the recommended technology and processes?
The FIRST step in establishing a security governance program is to?
Which of the following is MOST beneficial in determining an appropriate balance between uncontrolled innovation and excessive caution in an organization?
A recommended method to document the respective roles of groups and individuals for a given process is to:
A system was hardened at the Operating System level and placed into the production environment. Months later an audit was performed and it identified insecure configuration different from the original hardened state. Which of the following security issues is the MOST likely reason leading to the audit findings?
Which of the following functions evaluates risk present in IT initiatives and/or systems when implementing an information security program?
The organization does not have the time to remediate the vulnerability; however it is critical to release the application. Which of the following needs to be further evaluated to help mitigate the risks?
Which of the following represents the BEST method of ensuring security program alignment to business needs?
The ultimate goal of an IT security projects is:
How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?
A newly appointed security officer finds data leakage software licenses that had never been used. The officer decides to implement a project to ensure it gets installed, but the project gets a great deal of resistance across the organization. Which of the following represents the MOST likely reason for this situation?
Which of the following represents the best method of ensuring business unit alignment with security program requirements?
Risk appetite is typically determined by which of the following organizational functions?
The Security Operations Center (SOC) just purchased a new intrusion prevention system (IPS) that needs to be deployed in-line for best defense. The IT group is concerned about putting the new IPS in-line because it might negatively impact network availability. What would be the BEST approach for the CISO to reassure the IT group?
Which of the following methods are used to define contractual obligations that force a vendor to meet customer expectations?
A stakeholder is a person or group:
To get an Information Security project back on schedule, which of the following will provide the MOST help?
This occurs when the quantity or quality of project deliverables is expanded from the original project plan.
A person in your security team calls you at night and informs you that one of your web applications is potentially under attack from a cross-site scripting vulnerability. What do you do?
When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?
Which of the following is a major benefit of applying risk levels?
You currently cannot provide for 24/7 coverage of your security monitoring and incident response duties and your company is resistant to the idea of adding more full-time employees to the payroll. Which combination of solutions would help to provide the coverage needed without the addition of more dedicated staff? (choose the best answer):
When selecting a security solution with reoccurring maintenance costs after the first year, the CISO should: (choose the BEST answer)
When operating under severe budget constraints a CISO will have to be creative to maintain a strong security organization. Which example below is the MOST creative way to maintain a strong security posture during these difficult times?
Which of the following is the BEST indicator of a successful project?
An example of professional unethical behavior is:
Which of the following functions implements and oversees the use of controls to reduce risk when creating an information security program?
When gathering security requirements for an automated business process improvement program, which of the following is MOST important?
Which of the following is considered a project versus a managed process?
A severe security threat has been detected on your corporate network. As CISO you quickly assemble key members of the Information Technology team and business operations to determine a modification to security controls in response to the threat. This is an example of:
