Designing, Deploying, and Managing Security Controls ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An organization wants to deploy security controls by first addressing the highest-risk areas. Which deployment strategy aligns with this approach?

   • ACompliance-driven deployment
   • BCost-based deployment
   • CPhased deployment
   • DRisk-based deployment
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is designing a new remote access solution for its employees. The CISO wants to ensure that employees can only access the specific applications they need, and that access is granted based on the user's role and the security posture of their device. Which security control design principle is most relevant?

   • ASeparation of duties, by requiring multiple approvals for access requests.
   • BDefense in depth, by implementing multiple layers of authentication and network security.
   • CZero trust, by verifying every access request based on user identity, device health, and context.
   • DLeast privilege, by granting users only the access they need to perform their job functions.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A manufacturing company is rolling out a new access control system across 12 plants. The CISO wants to minimize operational disruption while ensuring that the highest-risk facilities (those handling proprietary designs) are protected first. The security team has limited staff and cannot deploy to all plants simultaneously. Which deployment strategy best aligns with these constraints?

   • ADeploy to all plants at once using a big-bang approach to ensure uniform security posture immediately.
   • BDeploy only to the plants with the lowest risk first to build confidence before touching critical facilities.
   • CStart with the two plants handling proprietary designs, then roll out to the remaining plants in phases based on risk.
   • DPilot the system at one low-risk plant, then roll out to all other plants simultaneously in the next quarter.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial services firm is designing a new customer-facing web application. The security architect wants to ensure that a single compromised component does not lead to full system compromise. The application will be hosted in a public cloud and will process sensitive customer data. Which design principle should be applied to meet this requirement?

   • AApply least privilege by granting each user only the minimum permissions required for their role.
   • BImplement defense in depth by layering network, host, application, and data security controls.
   • CUse a single strong authentication mechanism to reduce the attack surface.
   • DDeploy the application in a private cloud to isolate it from public network threats.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which phase of the security control management lifecycle involves continuously reviewing logs and alerts to detect potential security incidents?

   • AAssessment
   • BImplementation
   • CMaintenance
   • DMonitoring
   Reveal Solution Discussion Select an answer first