Certified Chief Information Security Officer (CCISO)

Last checked October 22, 2026 against the official EC-Council exam page.

1. Question 1Security Program Management and Operations

   Which measure best connects security spending to risk reduction when justifying a budget?

   1. ARisk reduction per unit of spend, measured by how much the residual risk falls for each investment that is made
   2. BThe number of security tools purchased in the year, regardless of whether each one is actually in use by the teams
   3. CThe total number of hours that staff spent on security activities, reported without any link to the outcomes achieved
   4. DThe count of security awareness posters printed and displayed around the office during the course of the year
   Show answer and explanationHide answer

   Correct answer: A

   Risk reduction per unit of spend links money directly to outcomes, which is what a budget decision needs. Tool counts, staff hours and poster counts measure activity rather than the risk that is actually removed.

2. Question 2Information Security Core Competencies

   Which principle best describes layering identity controls, network segmentation and endpoint protection so that one failure does not expose an asset?

   1. ALayered defence, where multiple independent controls protect each asset so that a single failure does not expose it
   2. BSingle-point defence, where one strong firewall protects all assets so that the rest of the controls can be simpler to run
   3. CSecurity by obscurity, where the design of each system is hidden so that attackers cannot easily plan an attack against it
   4. DPerimeter-only defence, where everything inside the firewall is trusted without further checks at any layer of the system
   Show answer and explanationHide answer

   Correct answer: A

   Layered defence uses several independent controls so that one failure does not leave the asset open. Single points of defence, obscurity and perimeter-only trust each rely on one barrier or on secrecy.

3. Question 3Strategic Planning, Finance, Procurement and Vendor Management

   Which financial measure best supports a business case for a security investment?

   1. AThe number of vendor logos on the first page of the proposal, which is taken to indicate the credibility of the bidders
   2. BThe number of staff who will be in the security team after the investment, regardless of what those staff achieve in their roles
   3. CThe colour of the proposal slides, chosen to match the company's branding guidelines for each board paper prepared
   4. DExpected loss avoided compared with the cost of the investment, which shows the value of reducing the risk
   Show answer and explanationHide answer

   Correct answer: D

   Comparing expected loss avoided with the investment cost shows whether the spending pays back in risk terms. Staff counts, slide colours and vendor logos do not measure the value of the investment.

4. Question 4Governance, Risk and Compliance

   A board asks how the security programme supports the business objectives. Which artefact best answers this question?

   1. AThe helpdesk ticket volume for the previous quarter, grouped by the department that raised each of the tickets
   2. BThe list of firewalls and their rule counts, sorted by the date on which each rule was last changed by an engineer
   3. CThe vendor's brochure describing the newest security products that the company may purchase during the coming year
   4. DA security strategy mapped to business objectives, with measurable goals and a named owner for each goal in the plan
   Show answer and explanationHide answer

   Correct answer: D

   A strategy linked to business objectives shows how security supports the mission, with measurable goals and accountable owners. Rule lists, vendor brochures and ticket volumes describe operations or purchasing and do not connect security to business aims.

5. Question 5Information Security Controls, Compliance and Audit Management

   An audit finds that a control is well designed but was not operating consistently during the audit period. What type of finding is this?

   1. AA design deficiency, meaning the control was never designed to address the risk that it was intended to address for the business
   2. BAn operating effectiveness deficiency, meaning the design is adequate but the control did not operate consistently in the period
   3. CA documentation gap only, meaning the control works in practice but the written procedure is missing a page of its steps
   4. DA scope exclusion, meaning the control was removed from the audit so that the auditors could not test it during the review
   Show answer and explanationHide answer

   Correct answer: B

   A well-designed control that did not operate consistently is an operating effectiveness deficiency. Design deficiencies concern the control's construction, documentation gaps concern paperwork, and scope exclusions concern what the audit covered.