Free PECB Chief Information Security Officer exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Chief Information Security Officer exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A confidential customer file is exposed to a person who lacks permission to read it. Which information security property has been compromised?

   1. A.Confidentiality of the fileCorrect answer: A
   2. B.Integrity of the file
   3. C.Availability of the file
   4. D.Authenticity of the file

   Explanation: NIST defines confidentiality as "Preserving authorized restrictions on information access and disclosure". Unauthorized reading breaches that restriction; it does not by itself establish alteration, unavailability, or a false origin.

   Reference: An Introduction to Information Security — Section 1.4, Confidentiality

2. 2A new business line changes the organization's mission priorities and stakeholder expectations. How should the CISO respond when setting cybersecurity priorities under CSF 2.0?

   1. A.Retain the earlier priorities without reviewing the new context
   2. B.Align priorities with the new mission and stakeholder expectationsCorrect answer: B
   3. C.Set priorities from product preferences independent of the mission
   4. D.Base priorities solely on the previous year's audit schedule

   Explanation: NIST says that governance prioritizes outcomes "in the context of its mission and stakeholder expectations." Security priorities should therefore reflect the business mission and stakeholder needs.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — p. 3, CSF Core Functions, GOVERN

3. 3How are outcomes organized in the NIST CSF 2.0 Core?

   1. A.Functions, then Categories, then SubcategoriesCorrect answer: A
   2. B.Categories, then Functions, then Subcategories
   3. C.Subcategories, then Categories, then Functions
   4. D.Functions, then Subcategories, then Categories

   Explanation: NIST describes the Core as "a set of cybersecurity outcomes arranged by Function, then Category, and finally Subcategory". These levels form the outcome hierarchy.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Section 2, Introduction to the CSF Core

4. 4An infected endpoint is still communicating with other internal systems. The response team isolates it to stop the incident from spreading. Which response objective does the isolation serve?

   1. A.Containment of the incidentCorrect answer: A
   2. B.Eradication of malicious persistence
   3. C.Recovery of affected operations
   4. D.Analysis of the incident's root cause

   Explanation: NIST states "Containment refers to preventing the expansion of an incident." Isolating the endpoint limits further spread.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — Section 3, incident mitigation, RS.MI-01

5. 5A CISO wants to track participants' phishing-reporting behavior over time after a training program. Which measure directly tracks that behavior?

   1. A.The percentage reporting simulated phishing before and after trainingCorrect answer: A
   2. B.The percentage completing training before the deadline
   3. C.The percentage rating the course useful immediately afterward
   4. D.The percentage attending each scheduled session

   Explanation: NIST identifies "Percentage of participants who changed a behavior in the workplace" as a behavior-change metric. Comparing phishing-reporting percentages before and after training tracks the observed reporting rate over time without establishing causation.

   Reference: Building a Cybersecurity and Privacy Learning Program — Section 2.4, Behavior Change per Participant

6. 6An attacker secretly changes approved payment instructions in a database. Which security property is directly affected by the unauthorized change?

   1. A.Availability of the records
   2. B.Integrity of the recordsCorrect answer: B
   3. C.Confidentiality of the records
   4. D.Privacy of the records

   Explanation: NIST describes integrity as "Guarding against improper information modification or destruction". An unauthorized change to approved instructions directly affects integrity.

   Reference: An Introduction to Information Security — Section 1.4, Integrity

7. 7An executive asks the CISO to connect cybersecurity governance with the organization's broader risk decisions. What relationship does the NIST CSF recommend?

   1. A.Separate cyber risk from enterprise risk management
   2. B.Treat technology cost as the entire enterprise risk
   3. C.Incorporate cyber risk into enterprise risk managementCorrect answer: C
   4. D.Replace enterprise risk management with system audits

   Explanation: NIST says governance activities are critical for "incorporating cybersecurity into an organization’s broader enterprise risk management (ERM) strategy." Cybersecurity should inform the broader portfolio of risks.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — p. 3, CSF Core Functions, GOVERN

8. 8A CISO wants to document which CSF outcomes the organization is currently achieving and to what extent. Which artifact serves this purpose?

   1. A.A Target Profile
   2. B.A Current ProfileCorrect answer: B
   3. C.A Community Profile
   4. D.A CSF Tier

   Explanation: NIST says "A Current Profile specifies the Core outcomes that an organization is currently achieving" and characterizes the extent of achievement.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Section 3.1, CSF Organizational Profiles

9. 9After containing an intrusion, a team removes malicious persistence mechanisms and closes the entry point. What incident response activity is it performing?

   1. A.Containment of incident expansion
   2. B.Eradication of incident effectsCorrect answer: B
   3. C.Recovery of normal operations
   4. D.Analysis of the incident timeline

   Explanation: NIST explains "After containment, eradication may be necessary to eliminate persistence mechanisms and entry points". Removing those mechanisms is eradication.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — Section 3, incident mitigation, RS.MI-02

10. 10A security learning program includes incident responders and new general users. How should the program set the complexity of role-based training?

    1. A.Use the advanced course for all learners regardless of role
    2. B.Match complexity to the role and learners' needsCorrect answer: B
    3. C.Choose complexity by seniority without regard to work role
    4. D.Choose complexity by technology platform without regard to work role

    Explanation: NIST recommends "ensure that the complexity of the training is commensurate with the role and needs of the people who will undergo the learning effort." Different roles and experience levels need suitable material.

    Reference: Building a Cybersecurity and Privacy Learning Program — Section 4, role-based training development