CertArea
All EC-Council exams

Free Certified Chief Information Security Officer (CCISO) practice test: 30 questions with answers

30 original questions for Certified Chief Information Security Officer (CCISO), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

Certified Chief Information Security Officer (CCISO) exam guide: topics, cost and format

All 30 Certified Chief Information Security Officer (CCISO) questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Security Program Management and Operations (6 questions)

  1. Question 1

    Which measure best connects security spending to risk reduction when justifying a budget?

    1. ARisk reduction per unit of spend, measured by how much the residual risk falls for each investment that is made
    2. BThe number of security tools purchased in the year, regardless of whether each one is actually in use by the teams
    3. CThe total number of hours that staff spent on security activities, reported without any link to the outcomes achieved
    4. DThe count of security awareness posters printed and displayed around the office during the course of the year
    Show answer and explanation
    Correct answer: A

    Risk reduction per unit of spend links money directly to outcomes, which is what a budget decision needs. Tool counts, staff hours and poster counts measure activity rather than the risk that is actually removed.

  2. Question 2

    Which operating model best separates security governance from security operations?

    1. AOperations sets the policy each morning based on the requests that come in from business units during the previous day's work
    2. BThe same team sets the policy, runs the firewalls and approves its own changes with no independent review at any point
    3. CSecurity governance sets policy and provides oversight, while the operations team runs the controls and responds to events day to day
    4. DGovernance is outsourced to the help desk, which handles security policy questions alongside password resets and account lockouts
    Show answer and explanation
    Correct answer: C

    Separating policy and oversight from day-to-day operations allows independent checks on the controls. A combined team, operations-set policy and a help desk owning governance each remove that separation.

  3. Question 3

    A critical SaaS vendor will handle sensitive company data. Which third-party security activity matters most at onboarding?

    1. ADue diligence on the vendor's controls and contract terms, including security obligations, breach notice and audit rights
    2. BChoosing the vendor's logo for the internal portal, so that staff recognise the new tool immediately when they sign in
    3. CGranting the vendor's support staff full administrator rights to every system, so that they can respond quickly in a crisis
    4. DWaiting until the first incident to ask the vendor about its security controls and the way it handles security incidents
    Show answer and explanation
    Correct answer: A

    Due diligence on controls and contract terms, including breach notice and audit rights, is the basis for managing third-party risk at onboarding. Logos, broad administrator rights and waiting for an incident all leave the risk unmanaged.

  4. Question 4

    Which metric best shows the health of a vulnerability management programme for executives?

    1. AMean time to remediate critical vulnerabilities, trended over time against the agreed remediation targets for each system
    2. BThe total number of scan reports generated by the scanner in each month, regardless of what the findings in them contain
    3. CThe count of vulnerabilities found in the lab environment, which is not part of the production systems the business relies on
    4. DThe number of employees who attended the scanner vendor's training course, expressed as a share of the total staff headcount
    Show answer and explanation
    Correct answer: A

    Mean time to remediate critical issues, trended against targets, shows whether exposure is being reduced at the pace the business needs. Report counts, lab findings and training attendance do not measure the state of production exposure.

  5. Question 5

    A business unit wants to skip a security review to launch faster. What should the CISO do?

    1. ARefuse any discussion and ban the business unit from launching anything until the start of the next budget cycle
    2. BApprove the skip without any record, since speed is the main priority for the business during the current period of growth
    3. CDocument the risk of skipping the review, have the business owner formally accept it, and set a deadline for completing the review
    4. DAsk the marketing team to decide whether the security review is necessary, since the marketing team owns the product launch
    Show answer and explanation
    Correct answer: C

    Documenting the risk, obtaining formal acceptance and setting a deadline keeps the decision visible and bounded. Unrecorded approval, blanket bans and handing the decision to marketing each avoid accountability in a different way.

  6. Question 6

    Which two elements make a security operations centre service effective? (Choose two.)

    1. ADefined escalation paths, runbooks and on-call coverage that match the criticality of the systems that are monitored
    2. BA feedback loop that tunes detections using analyst findings, so that false positives fall over time and alerts stay useful
    3. CAnalysts who work from one shared login, so that shift handovers are simpler to manage for the team in practice
    4. DAlerts sent to every employee's email inbox, so that staff notice a potential incident as soon as it happens at work
    5. EMonitoring that covers only the internet perimeter, so that the SOC does not need access to internal logs at all
    Show answer and explanation
    Correct answer: A, B

    Escalation paths and runbooks sized to system criticality, plus a feedback loop that tunes detection, make a SOC effective. Shared logins, mass email alerts and perimeter-only coverage each weaken accountability or visibility.

Information Security Core Competencies (6 questions)

  1. Question 7

    Which principle best describes layering identity controls, network segmentation and endpoint protection so that one failure does not expose an asset?

    1. ALayered defence, where multiple independent controls protect each asset so that a single failure does not expose it
    2. BSingle-point defence, where one strong firewall protects all assets so that the rest of the controls can be simpler to run
    3. CSecurity by obscurity, where the design of each system is hidden so that attackers cannot easily plan an attack against it
    4. DPerimeter-only defence, where everything inside the firewall is trusted without further checks at any layer of the system
    Show answer and explanation
    Correct answer: A

    Layered defence uses several independent controls so that one failure does not leave the asset open. Single points of defence, obscurity and perimeter-only trust each rely on one barrier or on secrecy.

  2. Question 8

    Which architecture approach best reduces the impact of a compromised identity?

    1. ADisabling multi-factor authentication for internal applications, so that users are never blocked during the working day
    2. BTrusting every user on the internal network, since internal users have already passed the perimeter firewall checks
    3. CSharing one administrator account across teams, which reduces the number of identities that could be compromised in future
    4. DZero trust, where each request is verified against identity, device and context rather than trusted because of its network location
    Show answer and explanation
    Correct answer: D

    Zero trust verifies each request against identity, device and context, so a compromised identity gains less reach. Implicit network trust, shared accounts and disabled multi-factor authentication all make a compromised identity more damaging.

  3. Question 9

    Which cryptographic requirement should a CISO set for protecting data at rest in new systems?

    1. AStrong encryption such as AES-256, with keys managed in a key management system that supports rotation and access logging
    2. BStoring the encryption key in the same file as the encrypted data, so that the key is always available to the system
    3. CUsing one static key for every system in the company, which is never rotated because rotation is disruptive to operations
    4. DEncrypting only the file names while leaving the file contents in clear text, so that the team can search them quickly
    Show answer and explanation
    Correct answer: A

    Strong encryption with managed, rotated keys and access logging is the standard requirement for data at rest. Keys stored beside the data, static shared keys and encrypting only names all defeat the protection.

  4. Question 10

    Which architecture principle best reduces the attack surface of a critical application?

    1. AAdding more open ports so that monitoring tools can reach every service without needing a firewall rule each time
    2. BMinimising exposed services and interfaces, and removing unused functions and components from the production environment
    3. CRunning the application with the broadest permissions available on the server, so that it never fails at runtime for lack of rights
    4. DPublishing the full source code and the administrative interface on the public website to make the system transparent to users
    Show answer and explanation
    Correct answer: B

    Removing exposed services and unused components leaves fewer paths for an attacker. Extra open ports, broad permissions and public admin interfaces all enlarge the attack surface.

  5. Question 11

    Which activity should a CISO ensure is practised regularly for incident response?

    1. ADisabling alerts during the exercise, so that the team can focus only on the simulated scenario set out for the session
    2. BReading the incident response policy aloud at the annual all-hands meeting, with no practice exercise held at any other time
    3. CSending a test email to the help desk once a year and waiting for the team to reply during its normal working hours
    4. DTabletop exercises with executives and technical teams, testing decisions, communications and escalation paths under pressure
    Show answer and explanation
    Correct answer: D

    Tabletop exercises test decisions, communication and escalation with the people who must act, which reveals gaps before a real incident. Reading policy aloud, one test email and disabled alerts do not exercise the response.

  6. Question 12

    Which two controls are most effective against business email compromise? (Choose two.)

    1. AVerification of payment changes through a second channel, such as a call-back to a number already held on file
    2. BAllowing payment changes to be made by any employee who receives an email request from a supplier that looks genuine
    3. CMulti-factor authentication on email accounts, with monitoring for suspicious mail forwarding rules that are created
    4. DSharing the finance team's login details across the team, so that payment requests can be processed when one person is away
    5. EDisabling all email logging, since the logs contain payment details that could be read by unauthorised staff members
    Show answer and explanation
    Correct answer: A, C

    Out-of-band verification of payment changes and multi-factor authentication with forwarding-rule monitoring target the usual routes of business email compromise. Unverified changes, shared logins and disabled logging each make fraud easier or harder to detect.

Strategic Planning, Finance, Procurement and Vendor Management (6 questions)

  1. Question 13

    Which financial measure best supports a business case for a security investment?

    1. AThe number of vendor logos on the first page of the proposal, which is taken to indicate the credibility of the bidders
    2. BThe number of staff who will be in the security team after the investment, regardless of what those staff achieve in their roles
    3. CThe colour of the proposal slides, chosen to match the company's branding guidelines for each board paper prepared
    4. DExpected loss avoided compared with the cost of the investment, which shows the value of reducing the risk
    Show answer and explanation
    Correct answer: D

    Comparing expected loss avoided with the investment cost shows whether the spending pays back in risk terms. Staff counts, slide colours and vendor logos do not measure the value of the investment.

  2. Question 14

    A procurement team proposes the cheapest security vendor without any security assessment. What should the CISO insist on?

    1. ASigning the contract first and assessing the vendor later, once the vendor has already been paid for the first period
    2. BA security assessment of the vendor, with contractual security requirements, completed before the contract is signed
    3. CAccepting the vendor's self-declared security statement without any review, so that the purchase is not delayed any further
    4. DSkipping the assessment because the vendor is cheaper, on the basis that the saving will later pay for security improvements
    Show answer and explanation
    Correct answer: B

    A security assessment with contractual requirements, completed before signing, lets the organisation choose and bind the vendor on security terms. Signing first, relying on self-declarations and skipping the assessment all leave the decision unverified.

  3. Question 15

    Which strategic planning method helps a CISO prioritise security investments over a three-year horizon?

    1. AA list of every security tool on the market, ranked by the vendor's marketing budget for the year ahead in the sector
    2. BA risk-based roadmap that sequences initiatives by risk reduction, dependency and cost, and is reviewed every year
    3. CA three-year plan that is never revised, so that the team can measure its success against the original plan each year
    4. DA purchase schedule driven by the vendors' end-of-quarter discounts, regardless of the risks that each purchase would address
    Show answer and explanation
    Correct answer: B

    A risk-based roadmap sequences work by risk reduction, dependencies and cost, and yearly review keeps it current. Vendor marketing, a plan that is never revised and discount-driven purchasing do not set priorities by risk.

  4. Question 16

    How should a CISO communicate the security programme's value to the board?

    1. ABy listing every alert the SOC handled last week in alphabetical order, with the analyst's notes beside each alert
    2. BIn technical detail on each firewall rule and the packet counts for each rule over the previous week of operation
    3. CIn business terms, showing risk exposure, progress against targets and the decisions that are needed from the board
    4. DBy presenting the vendor's sales pitch for its newest product line as the security strategy for the coming year
    Show answer and explanation
    Correct answer: C

    Boards need risk exposure, progress and decisions in business terms. Packet-level detail, raw alert lists and vendor sales pitches do not give the board what it needs to govern.

  5. Question 17

    A vendor has an incident that affects the company's data. What should the contract allow the company to require?

    1. AA right for the vendor to decide alone whether the company is told about the incident, and when the company is told
    2. BA promise that the vendor will not discuss the incident with the company unless the company asks for the information in writing
    3. CTimely incident notification, cooperation with the investigation, and clear remedies such as recovery of the costs incurred
    4. DA clause that removes all of the company's rights to its data after an incident, leaving the vendor in full control of the data
    Show answer and explanation
    Correct answer: C

    Timely notice, investigation cooperation and cost recovery give the company the information and remedies it needs after an incident at a vendor. Withholding information or transferring control of data to the vendor works against the company.

  6. Question 18

    Which two items should a vendor exit plan contain? (Choose two.)

    1. AData return and deletion steps, with timelines and proof of destruction for the data held by the vendor
    2. BService continuity arrangements, with a list of alternative suppliers that could take over the service if the exit is needed
    3. CThe vendor's list of favourite holiday destinations, which the contract team reviews when planning their own travel
    4. DA decision to renew automatically, whatever the performance has been, so that the exit is never needed in practice
    5. ELogo placement rules for the vendor's name on the company's internal intranet pages across the organisation's sites
    Show answer and explanation
    Correct answer: A, B

    A tested exit plan covers data return and destruction with proof, and continuity with alternative suppliers. Holiday lists, automatic renewal and logo rules do not help the company leave a vendor safely.

Governance, Risk and Compliance (6 questions)

  1. Question 19

    A board asks how the security programme supports the business objectives. Which artefact best answers this question?

    1. AThe helpdesk ticket volume for the previous quarter, grouped by the department that raised each of the tickets
    2. BThe list of firewalls and their rule counts, sorted by the date on which each rule was last changed by an engineer
    3. CThe vendor's brochure describing the newest security products that the company may purchase during the coming year
    4. DA security strategy mapped to business objectives, with measurable goals and a named owner for each goal in the plan
    Show answer and explanation
    Correct answer: D

    A strategy linked to business objectives shows how security supports the mission, with measurable goals and accountable owners. Rule lists, vendor brochures and ticket volumes describe operations or purchasing and do not connect security to business aims.

  2. Question 20

    Which tool gives a common structure for mapping security controls to the requirements of several obligations at once?

    1. AThe company's office seating plan, which records which team sits beside which other team on each floor of the building
    2. BA control framework such as ISO 27001 or the NIST Cybersecurity Framework, used to map controls to requirements and measure gaps
    3. CA software licence register, which lists each licence along with the date on which it was last renewed by the purchasing team
    4. DThe annual holiday calendar, which shows which staff members are away on leave during each period of the coming year
    Show answer and explanation
    Correct answer: B

    A recognised control framework provides shared categories that map to several obligations, which lets one control satisfy multiple requirements. Seating plans, licence registers and holiday calendars do not map controls to requirements.

  3. Question 21

    A regulator fines the company for failing a privacy requirement. Which governance gap most likely caused the failure?

    1. AA single firewall vendor used across the estate, which reduced the variety of controls available for the business to choose
    2. BToo many security awareness emails sent to staff, which distracted employees from the privacy requirement they needed to read
    3. CNo accountable owner for mapping and monitoring the privacy obligations, so the requirements were never tracked to controls
    4. DLong server names that made the configuration files hard to read for the operations team during routine maintenance work
    Show answer and explanation
    Correct answer: C

    Without an accountable owner, privacy obligations are not mapped to controls or monitored, so gaps persist unnoticed. Email volume, vendor choice and naming conventions are operational issues that do not explain a regulatory failure on this scale.

  4. Question 22

    Which risk statement follows the standard format for a risk register entry?

    1. AIf the vendor's API key is exposed, customer data could be accessed by unauthorised parties, causing regulatory penalties and loss of trust
    2. BThe API is badly designed and needs fixing soon, since the team has noticed that it is slow to respond to some requests
    3. CStaff keep reusing the same password on many sites, which is risky, so somebody should do something about passwords soon
    4. DRisk score of 9 on the register, with no description, owner or treatment recorded against the entry in the register system
    Show answer and explanation
    Correct answer: A

    A standard risk statement names the cause, the event and the consequence, which allows it to be rated and treated. Vague statements and unscored entries without owners cannot be prioritised or managed.

  5. Question 23

    Which two elements belong in a risk appetite statement? (Choose two.)

    1. AThe types and levels of risk that the board is willing to accept in order to achieve its objectives
    2. BThe name of the risk manager's preferred project management tool, which the team uses to track each open risk action
    3. CThresholds that trigger escalation to the board when a risk exceeds the level the board has agreed to accept
    4. DThe list of employees who may approve personal expenses for the team's offsite meeting later in the coming quarter
    5. EThe colours used in the risk heat map on the last slide of the presentation to the board of directors each year
    Show answer and explanation
    Correct answer: A, C

    Appetite statements define acceptable risk types and levels, and escalation thresholds tell management when a risk needs its decision. Tool preferences, expense approvals and colour choices are not part of appetite.

  6. Question 24

    Which governance body typically approves the risk appetite and receives security reports for oversight?

    1. AThe external marketing agency, which reviews the company's security claims before each product launch during the year
    2. BThe IT service desk team, which receives the security reports and forwards them by email to every employee in the company
    3. CThe board or a board committee, which approves the risk appetite and receives regular security reports for oversight
    4. DThe facilities team, which approves the security risk appetite at the same time as it approves the office access card designs
    Show answer and explanation
    Correct answer: C

    The board or a board committee sets risk appetite and holds management to account through regular security reporting. Service desks, marketing agencies and facilities teams do not carry that oversight responsibility.

Information Security Controls, Compliance and Audit Management (6 questions)

  1. Question 25

    An audit finds that a control is well designed but was not operating consistently during the audit period. What type of finding is this?

    1. AA design deficiency, meaning the control was never designed to address the risk that it was intended to address for the business
    2. BAn operating effectiveness deficiency, meaning the design is adequate but the control did not operate consistently in the period
    3. CA documentation gap only, meaning the control works in practice but the written procedure is missing a page of its steps
    4. DA scope exclusion, meaning the control was removed from the audit so that the auditors could not test it during the review
    Show answer and explanation
    Correct answer: B

    A well-designed control that did not operate consistently is an operating effectiveness deficiency. Design deficiencies concern the control's construction, documentation gaps concern paperwork, and scope exclusions concern what the audit covered.

  2. Question 26

    Which evidence approach gives auditors reliable proof that a control operates as described?

    1. AAsking the control owner to confirm verbally that the control worked during the period in every case that occurred
    2. BSampling transactions or events across the audit period and retaining the evidence for each sampled item tested
    3. CShowing the auditors the policy document alone, which states what the control is designed to do but not how it ran
    4. DProviding a summary slide prepared by the team the day before the audit starts, so that the auditors can review the points
    Show answer and explanation
    Correct answer: B

    Sampling across the period, with retained evidence for each item, lets auditors test operation rather than rely on assertion. Verbal confirmation, policy text alone and summary slides do not show that the control ran.

  3. Question 27

    A regulator asks for evidence of continuous control monitoring. Which capability best meets this request?

    1. AQuarterly email reminders to staff asking them to confirm that they follow the controls described in the policy set
    2. BAn annual manual checklist completed by the security manager at the end of each calendar year for the whole estate
    3. CA policy stating that the controls are monitored, with no record kept of the monitoring activity that actually takes place
    4. DAutomated control testing with evidence collected on a schedule, and exceptions routed to the named control owners
    Show answer and explanation
    Correct answer: D

    Automated testing with scheduled evidence and routed exceptions gives continuous, verifiable monitoring. Annual checklists, unsupported policy statements and reminder emails do not show ongoing monitoring.

  4. Question 28

    What is the main benefit of aligning security controls to a recognised framework during an audit?

    1. AIt removes the need for the company's own risk assessment, since the framework has already assessed the risks for it
    2. BIt guarantees that the company will pass every audit without any findings from the auditors on any control at all
    3. CIt gives a common vocabulary and a mapping that lets one piece of evidence satisfy several obligations at the same time
    4. DIt lets the marketing team describe the company's controls using the framework's name in advertisements to customers
    Show answer and explanation
    Correct answer: C

    A framework mapping lets evidence satisfy several obligations and gives a shared language for auditors and management. No framework guarantees a clean audit, replaces the company's own risk assessment, or licenses marketing claims.

  5. Question 29

    Which two audit findings would most concern an audit committee? (Choose two.)

    1. AA critical privileged access control that has not operated for several months, with no compensating control in place
    2. BA minor typo in an internal policy document that has no effect at all on how the underlying control is run in practice
    3. CRepeated failures of a control with the same root cause, which management has not addressed across several audit cycles
    4. DA new security logo that the design team has not yet approved for use on the internal intranet site across the company
    5. EThe number of coffee machines in the office that need servicing during the coming quarter of the financial year ahead
    Show answer and explanation
    Correct answer: A, C

    A critical control failing without compensation and recurring failures with the same root cause both indicate material risk that the committee must act on. Typos, logos and office equipment do not affect control effectiveness.

  6. Question 30

    An auditor asks for evidence that backup restores are tested. What is the strongest evidence?

    1. AA statement in the backup policy that restores are tested, with no test records kept for the auditor to review at any point
    2. BRecords of scheduled restore tests, with the restored data checked against the source and the results retained for review
    3. CThe backup vendor's marketing claim that every restore is guaranteed to succeed on the first attempt made by the customer
    4. DA verbal confirmation from the backup administrator that restores work when they are needed for the business in an emergency
    Show answer and explanation
    Correct answer: B

    Retained test records, with the restored data checked against the source, show that restores actually work. A policy statement, a vendor claim and a verbal assurance do not demonstrate the test.