Certified Chief Information Security Officer (CCISO) Practice Questions
Prepare for 712-50 with more than an answer.
- Exam fee
- $950 USD
- Level
- Executive
- Valid for
- 3 years
Domains covered on the exam 5
- Governance, Risk, Compliance21%
- Information Security Controls and Audit Management20%
- Security Program Management & Operations21%
- Information Security Core Competencies19%
- Strategic Planning, Finance, Procurement, and Third-Party Management19%
- 1
A new CISO discovers that the organization's 'Risk Register' is a static spreadsheet that hasn't been updated in two years. To maturity the risk management program, what should be the immediate next step?
Show answer details
Correct answer: B
Before buying tools or creating complex processes, the CISO must re-baseline the understanding of risk by engaging with the business. A static register is likely outdated; human validation is the critical first step to reviving the process.
- 2
You are presenting a budget request for a Zero Trust Network Architecture project. The CFO asks, 'Why do we need this if we already have firewalls and VPNs?' Which financial justification aligns best with strategic planning principles?
Show answer details
Correct answer: B
This answer speaks the CFO's language (insurance premiums, liability, enabling remote work business model) rather than just technical features.
- 3
When negotiating a contract with a Cloud Service Provider (CSP), which clause is MOST critical for ensuring the organization's ability to investigate a security incident?
Show answer details
Correct answer: B
Without a contractual 'Right to Audit' or access to raw logs, the customer is blind during an incident. CSPs may not provide detailed logs by default unless specified in the contract.
- 4
Review the following supply chain risk assessment flow. At which stage is the 'Fourth-Party Risk' typically identified?
flowchart LR A[Identify Vendor] --> B[Initial Screening] B --> C[Detailed Questionnaire] C --> D[Review & Score] D --> E{Risk Acceptable?} E -->|Yes| F[Contracting] E -->|No| G[Remediation or Reject]Show answer details
Correct answer: B
Fourth-party risk (the vendor's vendors) is typically identified during the Detailed Questionnaire stage, where specific questions about the vendor's outsourcing and subcontracting practices are asked.
- 5
The organization uses a DevOps pipeline where code is deployed to production 50 times a day. The security team cannot manually review every change. Which approach best integrates security without slowing down velocity (DevSecOps)?
Show answer details
Correct answer: B
Automating security testing (SAST/DAST) inside the pipeline allows for speed. Configuring it to 'break the build' only on critical issues balances security needs with the business requirement for velocity.
- 6
A CISO is defining the 'Risk Appetite' for the organization. Which statement represents a properly formed Risk Appetite Statement?
Show answer details
Correct answer: B
A good risk appetite statement is specific, measurable, and tailored to different categories (operational vs privacy). 'Zero risk' is impossible, making option A invalid.
- 7
Which of the following is the PRIMARY benefit of implementing an ISO 27001 certified Information Security Management System (ISMS)?
Show answer details
Correct answer: B
ISO 27001 is about the management system (ISMS) itself—providing a structured, systematic process for managing risk. It does not guarantee security (prevention of all breaches) but ensures a process is in place to manage it.
- 8
As the CISO of a multinational financial institution, you are presenting the annual information security strategy to the Board of Directors. The Board Chair questions why the proposed budget for 'Risk Management' has increased by 40% despite no significant security incidents occurring in the previous fiscal year. Which response best demonstrates alignment between security governance and business objectives?
Show answer details
Correct answer: B
This is the optimal answer because it ties the security investment directly to the Board's risk appetite and the business goal of expansion. It demonstrates that security is a business enabler rather than just a cost center or technical necessity.
- 9
A global healthcare provider is acquiring a smaller regional hospital network. During the due diligence phase, you identify that the target company uses a legacy EMR system that cannot be patched against several critical vulnerabilities. The business strategy relies on integrating this network within 90 days. What is the most appropriate governance approach to handle this risk?
Show answer details
Correct answer: C
In an M&A scenario where business drivers are strong, the CISO must find a way to enable the business while managing risk. Implementing strong compensating controls (segmentation, virtual patching) allows operations to continue safely while formally documenting the risk ensures governance transparency.
- 10
You are establishing a new Enterprise Risk Management (ERM) framework. You need to define the process for risk treatment decisions. Review the diagram below representing the decision logic. Which logic flow correctly represents the standard risk treatment methodology based on ISO 31000 principles?
flowchart TD Start[Risk Identified] --> Assess{Risk > Appetite?} Assess -->|No| A[Monitor] Assess -->|Yes| Cost{Cost of Control < Impact?} Cost -->|Yes| B[Treat/Mitigate] Cost -->|No| Crit{Is Risk Critical?} Crit -->|Yes| C[Transfer/Avoid] Crit -->|No| D[Accept]Show answer details
Correct answer: A
The diagram correctly follows standard risk management logic: If risk exceeds appetite, we check if mitigation is cost-effective. If yes, we mitigate. If no (too expensive), we check criticality. If critical, we must transfer (insurance) or avoid (stop activity). If not critical and too expensive to fix, we formally accept.
