EC-Council Certified CISO (CCISO) Questions and Answers
The Information Security Governance program MUST:
The purpose of NIST SP 800-53 as part of the NIST System Certification and Accreditation Project is to establish a set of standardized, minimum security controls for IT systems addressing low, moderate, and high levels of concern for
Which of the following most commonly falls within the scope of an information security governance steering committee?
Which of the following are the MOST important factors for proactively determining system vulnerabilities?
A global retail company is creating a new compliance management process. Which of the following regulations is of MOST importance to be tracked and managed by this process?
Which of the following should be determined while defining risk management strategies?
The single most important consideration to make when developing your security program, policies, and processes is:
Risk appetite directly affects what part of a vulnerability management program?
If your organization operates under a model of "assumption of breach", you should:
The exposure factor of a threat to your organization is defined by?
A company wants to fill a Chief Information Security Officer position in the organization. They need to define and implement a more holistic security program. Which of the following qualifications and experience would be MOST desirable to find in a candidate?
An organization information security policy serves to
The establishment of a formal risk management framework and system authorization program is essential. The LAST step of the system authorization process is:
Who in the organization determines access to information?
A Security Operations Centre (SOC) manager is informed that a database containing highly sensitive corporate strategy information is under attack. Information has been stolen and the database server was disconnected. Who must be informed of this incident?
Which of the following is a critical operational component of an Incident Response Program (IRP)?
What should an organization do to ensure that they have a sound Business Continuity (BC) Plan?
What is the BEST way to achieve on-going compliance monitoring in an organization?
Regulatory requirements typically force organizations to implement
What is the definition of Risk in Information Security?
What is the SECOND step to creating a risk management methodology according to the National Institute of Standards and Technology (NIST) SP 800-30 standard?
In accordance with best practices and international standards, how often is security awareness training provided to employees of an organization?
When an organization claims it is secure because it is PCI-DSS certified, what is a good first question to ask towards assessing the effectiveness of their security program?
From the CISO’s perspective in looking at financial statements, the statement of retained earnings of an organization:
You are the CISO for an investment banking firm. The firm is using artificial intelligence (AI) to assist in approving clients for loans.
Which control is MOST important to protect AI products?
Which of the following provides the BEST approach to achieving positive outcomes while preserving savings?
You have been promoted to the CISO of a big-box retail store chain reporting to the Chief Information Officer (CIO). The CIO’s first mandate to you is to develop a cybersecurity compliance framework that will meet all the store’s compliance requirements.
Which of the following compliance standard is the MOST important to the organization?
XYZ is a publicly-traded software development company.
Who is ultimately accountable to the shareholders in the event of a cybersecurity breach?
When obtaining new products and services, why is it essential to collaborate with lawyers, IT security professionals, privacy professionals, security engineers, suppliers, and others?
What is the THIRD state of the Tuckman Stages of Group Development?
You have been promoted to the CISO of a retail store. Which of the following compliance standards is the MOST important to the organization?
What is the MOST critical output of the incident response process?
What are the common data hiding techniques used by criminals?
When evaluating a Managed Security Services Provider (MSSP), which service(s) is/are most important:
When performing a forensic investigation, what are the two MOST common data sources for obtaining evidence from a computer and mobile devices?
What key technology can mitigate ransomware threats?
When reviewing a Solution as a Service (SaaS) provider’s security health and posture, which key document should you review?
What is an approach to estimating the strengths and weaknesses of alternatives used to determine options, which provide the BEST approach to achieving benefits while preserving savings called?
A cloud computing environment that is bound together by technology that allows data and applications to be shared between public and private clouds is BEST referred to as a?
To make sure that the actions of all employees, applications, and systems follow the organization’s rules and regulations can BEST be described as which of the following?
Many successful cyber-attacks currently include:
What is the purpose of the statement of retained earnings of an organization?
Who is responsible for verifying that audit directives are implemented?
What organizational structure combines the functional and project structures to create a hybrid of the two?
With a focus on the review and approval aspects of board responsibilities, the Data Governance Council recommends that the boards provide strategic oversight regarding information and information security, include these four things:
As the CISO, you are the project sponsor for a highly visible log management project. The objective of the project is to centralize all the enterprise logs into a security information and event management (SIEM) system. You requested the results of the performance quality audits activity.
The performance quality audit activity is done in what project management process group?
SQL injection is a very popular and successful injection attack method. Identify the basic SQL injection text:
Your incident handling manager detects a virus attack in the network of your company. You develop a signature based on the characteristics of the detected virus. Which of the following phases in the incident handling process will utilize the signature to resolve this incident?
An access point (AP) is discovered using Wireless Equivalent Protocol (WEP). The ciphertext sent by the AP is encrypted with the same key and cipher used by its stations. What authentication method is being used?
Physical security measures typically include which of the following components?
Which of the following is the MAIN security concern for public cloud computing?
Which of the following is a symmetric encryption algorithm?
Which of the following is a countermeasure to prevent unauthorized database access from web applications?
The process for identifying, collecting, and producing digital information in support of legal proceedings is called
Your penetration testing team installs an in-line hardware key logger onto one of your network machines. Which of the following is of major concern to the security organization?
As a CISO you need to understand the steps that are used to perform an attack against a network. Put each step into the correct order.
1.Covering tracks
2.Scanning and enumeration
3.Maintaining Access
4.Reconnaissance
5.Gaining Access
One of your executives needs to send an important and confidential email. You want to ensure that the message cannot be read by anyone but the recipient. Which of the following keys should be used to encrypt the message?
The general ledger setup function in an enterprise resource package allows for setting accounting periods. Access to this function has been permitted to users in finance, the shipping department, and production scheduling. What is the most likely reason for such broad access?
What type of attack requires the least amount of technical equipment and has the highest success rate?
An anonymity network is a series of?
The process of creating a system which divides documents based on their security level to manage access to private data is known as
Network Forensics is the prerequisite for any successful legal action after attacks on your Enterprise Network. Which is the single most important factor to introducing digital evidence into a court of law?
Which of the following is MOST important when tuning an Intrusion Detection System (IDS)?
What is the FIRST step in developing the vulnerability management program?
Your organization provides open guest wireless access with no captive portals. What can you do to assist with law enforcement investigations if one of your guests is suspected of committing an illegal act using your network?
The ability to hold intruders accountable in a court of law is important. Which of the following activities are needed to ensure the highest possibility for successful prosecution?
What is the term describing the act of inspecting all real-time Internet traffic (i.e., packets) traversing a major Internet backbone without introducing any apparent latency?
Security related breaches are assessed and contained through which of the following?
A customer of a bank has placed a dispute on a payment for a credit card account. The banking system uses digital signatures to safeguard the integrity of their transactions. The bank claims that the system shows proof that the customer in fact made the payment. What is this system capability commonly known as?
Which of the following information would MOST likely be reported at the board-level within an organization?
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
Once supervisors and data owners have approved requests, information system administrators will implement
As the CISO you need to write the IT security strategic plan. Which of the following is the MOST important to review before you start writing the plan?
At what level of governance are individual projects monitored and managed?
When updating the security strategic planning document what two items must be included?
Which of the following conditions would be the MOST probable reason for a security project to be rejected by the executive board of an organization?
Scenario: Your program is developed around minimizing risk to information by focusing on people, technology, and operations.
You have decided to deal with risk to information from people first. How can you minimize risk to your most sensitive information before granting access?
What process defines the framework of rules and practices by which a board of directors ensure accountability, fairness and transparency in an organization's relationship with its shareholders?
The newly appointed CISO of an organization is reviewing the IT security strategic plan. Which of the following is the MOST important component of the strategic plan?
Which of the following best describes a portfolio?
Scenario: An organization has made a decision to address Information Security formally and consistently by adopting established best practices and industry standards. The organization is a small retail merchant but it is expected to grow to a global customer base of many millions of customers in just a few years.
Which of the following frameworks and standards will BEST fit the organization as a baseline for their security program?
Simon had all his systems administrators implement hardware and software firewalls to ensure network
security. They implemented IDS/IPS systems throughout the network to check for and stop any unauthorized
traffic that may attempt to enter. Although Simon and his administrators believed they were secure, a hacker
group was able to get into the network and modify files hosted on the company's website. After searching
through the firewall and server logs, no one could find how the attackers were able to get in. He decides that
the entire network needs to be monitored for critical and essential file changes. This monitoring tool alerts
administrators when a critical file is altered. What tool could Simon and his administrators implement to
accomplish this?
A CISO decides to analyze the IT infrastructure to ensure security solutions adhere to the concepts of how
hardware and software is implemented and managed within the organization. Which of the following principles
does this best demonstrate?
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
After determining the audit findings are accurate, which of the following is the MOST logical next activity?
SCENARIO: A Chief Information Security Officer (CISO) recently had a third party conduct an audit of the security program. Internal policies and international standards were used as audit baselines. The audit report was presented to the CISO and a variety of high, medium and low rated gaps were identified.
The CISO has validated audit findings, determined if compensating controls exist, and started initial remediation planning. Which of the following is the MOST logical next step?
Scenario: The new CISO was informed of all the Information Security projects that the section has in progress. Two projects are over a year behind schedule and way over budget.
Which of the following will be most helpful for getting an Information Security project that is behind schedule back on schedule?
What are the primary reasons for the development of a business case for a security project?
Which regulation or policy governs protection of personally identifiable user data gathered during a cyber investigation?
Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.
The CISO has been able to implement a number of technical controls and is able to influence the Information Technology teams but has not been able to influence the rest of the organization. From an organizational perspective, which of the following is the LIKELY reason for this?
Scenario: Your organization employs single sign-on (user name and password only) as a convenience to your employees to access organizational systems and data. Permission to individual systems and databases is vetted and approved through supervisors and data owners to ensure that only approved personnel can use particular applications or retrieve information. All employees have access to their own human resource information, including the ability to change their bank routing and account information and other personal details through the Employee Self-Service application. All employees have access to the organizational VPN.
What type of control is being implemented by supervisors and data owners?
You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget.
Using the best business practices for project management you determine that the project correct aligns with the company goals. What needs to be verified FIRST?
A newly-hired CISO needs to understand the organization’s financial management standards for business units
and operations. Which of the following would be the best source of this information?
SCENARIO: A CISO has several two-factor authentication systems under review and selects the one that is most sufficient and least costly. The implementation project planning is completed and the teams are ready to implement the solution. The CISO then discovers that the product it is not as scalable as originally thought and will not fit the organization’s needs.
The CISO discovers the scalability issue will only impact a small number of network segments. What is the next logical step to ensure the proper application of risk management methodology within the two-facto implementation project?
You are the Chief Information Security Officer of a large, multinational bank and you suspect there is a flaw in a two factor authentication token management process. Which of the following represents your BEST course of action?
The risk found after a control has been fully implemented is called:
Which of the following reports should you as an IT auditor use to check on compliance with a service level agreement’s requirement for uptime?
Which of the following BEST describes an international standard framework that is based on the security model Information Technology—Code of Practice for Information Security Management?
Which of the following activities is the MAIN purpose of the risk assessment process?
Many times a CISO may have to speak to the Board of Directors (BOD) about their cyber security posture. What would be the BEST choice of security metrics to present to the BOD?
Which of the following activities results in change requests?
Which International Organization for Standardization (ISO) below BEST describes the performance of risk management, and includes a five-stage risk management methodology.
Which of the following is the PRIMARY purpose of International Organization for Standardization (ISO) 27001?
Which of the following is the MOST important goal of risk management?
A new CISO just started with a company and on the CISO's desk is the last complete Information Security Management audit report. The audit report is over two years old. After reading it, what should be the CISO's FIRST priority?
Which of the following is a fundamental component of an audit record?
As a new CISO at a large healthcare company you are told that everyone has to badge in to get in the building. Below your office window you notice a door that is normally propped open during the day for groups of people to take breaks outside. Upon looking closer you see there is no badge reader. What should you do?
When working in the Payment Card Industry (PCI), how often should security logs be review to comply with the standards?
As the new CISO at the company you are reviewing the audit reporting process and notice that it includes only detailed technical diagrams. What else should be in the reporting process?
The amount of risk an organization is willing to accept in pursuit of its mission is known as
Which of the following best describes the purpose of the International Organization for Standardization (ISO) 27002 standard?
When measuring the effectiveness of an Information Security Management System which one of the following would be MOST LIKELY used as a metric framework?
The patching and monitoring of systems on a consistent schedule is required by?
Which of the following represents the BEST reason for an organization to use the Control Objectives for Information and Related Technology (COBIT) as an Information Technology (IT) framework?
Creating a secondary authentication process for network access would be an example of?
When you develop your audit remediation plan what is the MOST important criteria?
When a CISO considers delaying or not remediating system vulnerabilities which of the following are MOST important to take into account?
Information Security is often considered an excessive, after-the-fact cost when a project or initiative is completed. What can be done to ensure that security is addressed cost effectively?
As the CISO for your company you are accountable for the protection of information resources commensurate with:
Which of the following will be MOST helpful for getting an Information Security project that is behind schedule back on schedule?
The security team has investigated the theft/loss of several unencrypted laptop computers containing sensitive corporate information. To prevent the loss of any additional corporate data it is unilaterally decided by the CISO that all existing and future laptop computers will be encrypted. Soon, the help desk is flooded with complaints about the slow performance of the laptops and users are upset. What did the CISO do wrong? (choose the BEST answer):
A department within your company has proposed a third party vendor solution to address an urgent, critical business need. As the CISO you have been asked to accelerate screening of their security control claims. Which of the following vendor provided documents is BEST to make your decision:
Which of the following represents the BEST method of ensuring security program alignment to business needs?
Which of the following is considered a project versus a managed process?
Which of the following best summarizes the primary goal of a security program?
When managing the critical path of an IT security project, which of the following is MOST important?
An example of professional unethical behavior is:
When gathering security requirements for an automated business process improvement program, which of the following is MOST important?
Which business stakeholder is accountable for the integrity of a new information system?
The company decides to release the application without remediating the high-risk vulnerabilities. Which of the following is the MOST likely reason for the company to release the application?
A CISO sees abnormally high volumes of exceptions to security requirements and constant pressure from business units to change security processes. Which of the following represents the MOST LIKELY cause of this situation?
How often should the Statements of Standards for Attestation Engagements-16 (SSAE16)/International Standard on Assurance Engagements 3402 (ISAE3402) report of your vendors be reviewed?
Acme Inc. has engaged a third party vendor to provide 99.999% up-time for their online web presence and had them contractually agree to this service level agreement. What type of risk tolerance is Acme exhibiting? (choose the BEST answer):
When selecting a security solution with reoccurring maintenance costs after the first year, the CISO should: (choose the BEST answer)
Which one of the following BEST describes which member of the management team is accountable for the day-to-day operation of the information security program?
A severe security threat has been detected on your corporate network. As CISO you quickly assemble key members of the Information Technology team and business operations to determine a modification to security controls in response to the threat. This is an example of:
You are the CISO of a commercial social media organization. The leadership wants to rapidly create new methods of sharing customer data through creative linkages with mobile devices. You have voiced concern about privacy regulations but the velocity of the business is given priority. Which of the following BEST describes this organization?
Which of the following methodologies references the recommended industry standard that Information security project managers should follow?
When entering into a third party vendor agreement for security services, at what point in the process is it BEST to understand and validate the security posture and compliance level of the vendor?
In effort to save your company money which of the following methods of training results in the lowest cost for the organization?
