Free Certified Chief Information Security Officer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Chief Information Security Officer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A CISO is revising security governance after the organization changes its mission. What should guide the revised cybersecurity risk decisions?

   1. A. The existing security product renewal schedule
   2. B. The organization's revised mission and objectives
   3. C. The controls most frequently used by competitors
   4. D. The technical preferences of the security team

   Answer: B

   Explanation: NIST states, "The organizational mission is understood and informs cybersecurity risk management". The revised mission should guide governance decisions; product schedules and technical preferences do not establish organizational purpose.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Appendix A, GV.OC-01, p. 16

2. 2A security executive leads both experienced specialists and newly formed teams. Which approach reflects OPM's definition of leadership across these situations?

   1. A. Adapt leadership style to the situation
   2. B. Use the same direction for every experience level
   3. C. Base influence entirely on reporting authority
   4. D. Replace team motivation with task inspection

   Answer: A

   Explanation: OPM defines leadership as "Influences, motivates, and challenges others; adapts leadership styles to a variety of situations." Different team circumstances warrant adaptation; a single fixed approach or reliance on authority alone misses that element.

   Reference: OPM Program and Project Competency Model and Competency Definitions, Appendix D — General Competencies, Leadership

3. 3A control is installed, but the CISO needs evidence that it meets the intended security requirement. What should the control assessment establish?

   1. A. Whether the control is installed and appears on the approved inventory
   2. B. Whether its settings match the vendor's recommended installation template
   3. C. Whether operators completed the control's configuration training course
   4. D. Whether it meets requirements through correct implementation and effective operation

   Answer: D

   Explanation: "implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements" Assessment must establish correct implementation, intended operation and the required result. Installation records, a template match, or staff training alone do not demonstrate those outcomes.

   Reference: NIST SP 800-53 Revision 5 — Security and Privacy Controls for Information Systems and Organizations — CA-2(d), Control Assessments, p. 84

4. 4A system enforces both mandatory and discretionary access controls. An ordinary user's discretionary permission would allow a transfer that the mandatory policy prohibits. Which policy governs the transfer?

   1. A. The discretionary policy because it is more specific to the user
   2. B. Whichever policy was configured more recently
   3. C. The mandatory policy takes precedence
   4. D. Whichever policy grants the greater access

   Answer: C

   Explanation: NIST states, "mandatory access control policies take precedence over the less rigorous constraints of AC-3(4)". For the ordinary subject in this scenario, discretionary permission does not override the mandatory restriction.

   Reference: NIST SP 800-53 Revision 5 — Security and Privacy Controls for Information Systems and Organizations — AC-3(3) discussion, Mandatory Access Control, p. 24

5. 5What is a principal benefit of integrating security requirements into the enterprise architecture?

   1. A. Security decisions can be postponed until individual systems are retired.
   2. B. Security controls can be selected independently of mission requirements.
   3. C. Security considerations remain connected to business processes throughout the system life cycle.
   4. D. Security architecture can replace the organization's business process architecture.

   Answer: C

   Explanation: "The integration of security and privacy requirements and controls into the enterprise architecture helps to ensure that security and privacy considerations are addressed throughout the system development life cycle and are explicitly related to the organization’s mission and business processes." Integration connects security to mission and business processes throughout development and operation; it does not postpone security or replace business architecture.

   Reference: NIST SP 800-53 Revision 5 — Security and Privacy Controls for Information Systems and Organizations — PM-7, Enterprise Architecture, discussion, pp. 206–207

6. 6Several departments each assume another department approves cybersecurity risk decisions. Which governance change directly addresses this accountability gap?

   1. A. Allow departments to infer authority from existing reporting lines
   2. B. Let the department identifying a risk assume final approval authority
   3. C. Assign approval authorities and communicate them to affected departments
   4. D. Treat agreement among technical staff as authorization to accept risk

   Answer: C

   Explanation: "Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced" The outcome requires established, communicated and understood authorities. Inference, automatic reporter authority and informal technical consensus do not establish who is authorized to approve a risk decision.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Appendix A, GV.RR-02, p. 17

7. 7A CISO needs cooperation from a business leader who does not report to the security organization. Which behavior demonstrates influencing and negotiating?

   1. A. Repeat the original proposal until discussion ends
   2. B. Build consensus through give and take
   3. C. Treat the absence of objections as a binding agreement
   4. D. Escalate each disagreement before exploring interests

   Answer: B

   Explanation: OPM describes influencing/negotiating as "Persuades others; builds consensus through give and take". Mutual engagement gains cooperation; silence, repetition, and immediate escalation do not demonstrate that behavior.

   Reference: OPM Supervisory Guide — Leadership Competencies, Influencing/Negotiating

8. 8Management has decided to mitigate several control deficiencies, but remediation cannot be completed immediately. Which document should track the planned corrective actions?

   1. A. A risk acceptance memorandum
   2. B. A plan of action and milestones
   3. C. A security assessment report
   4. D. A system configuration baseline

   Answer: B

   Explanation: "Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system" The POA&M records planned remediation and milestones. A risk acceptance memorandum records acceptance, an assessment report records assessment findings, and a configuration baseline records approved settings rather than the corrective-action plan.

   Reference: NIST SP 800-53 Revision 5 — Security and Privacy Controls for Information Systems and Organizations — CA-5(a), Plan of Action and Milestones, p. 88; RA-7 discussion, p. 241

9. 9An analyst needs read access to selected reports but has been granted database administration privileges for convenience. Which change applies least privilege?

   1. A. Grant only the access necessary for the assigned reporting tasks
   2. B. Retain administrator access but require a longer password
   3. C. Grant administrator access to all analysts to standardize permissions
   4. D. Keep broad access until the analyst changes departments

   Answer: A

   Explanation: AC-6 permits only authorized accesses "necessary to accomplish assigned organizational tasks". Stronger authentication does not reduce excess authorization, and uniform broad permissions still exceed the reporting need.

   Reference: NIST SP 800-53 Revision 5 — Security and Privacy Controls for Information Systems and Organizations — AC-6, Least Privilege, p. 36

10. 10During SWOT analysis for a security strategy, the CISO identifies an internal shortage of staff skilled in cloud security. How should this factor be classified?

    1. A. Strength
    2. B. Weakness
    3. C. Opportunity
    4. D. Threat

    Answer: B

    Explanation: "Weaknesses are negative factors internal your business." The skills shortage is an unfavorable internal condition. Threats and opportunities are external, while a strength is a positive internal capability.

    Reference: Do a SWOT analysis — Identify your weaknesses