Designing, Deploying, and Managing Security Controls ACCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is implementing a new access control system for its data center. The security team wants to ensure that only authorized personnel can enter the server room, and that access is logged and reviewed. Which combination of controls and lifecycle activities should be implemented?

   • AUse a fingerprint scanner but do not log access attempts.
   • BUse a simple key lock and do not keep any access records.
   • CUse a biometric access control system and maintain an access log that is reviewed monthly.
   • DUse a badge system and review access logs only when an incident occurs.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of assessing the effectiveness of security controls?

   • ATo assign blame for security incidents
   • BTo determine whether the controls are achieving their intended security objectives
   • CTo satisfy auditors without changing anything
   • DTo justify the security budget to executives
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which deployment strategy for security controls involves implementing controls in stages across different business units or locations over time?

   • AAgile deployment
   • BRisk-based deployment
   • CPhased deployment
   • DBig-bang deployment
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A software development company is implementing a new access control policy for its source code repository. The CISO wants to ensure that developers can only access the code they need for their current projects, and that access is reviewed regularly. Which combination of principles and practices should be applied?

   • AImplement mandatory access control (MAC) based on security labels and clearances.
   • BUse a single shared account for all developers to simplify management.
   • CImplement role-based access control (RBAC) with periodic access reviews and remove access when projects end.
   • DGrant all developers access to all repositories to avoid delays in collaboration.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has implemented a security control that restricts access to sensitive files based on the user's job role. The control is effective, but it has caused delays because employees sometimes need temporary access to files outside their role for special projects. The company wants to maintain security while enabling these temporary needs. What is the best approach?

   • AImplement a temporary access request process that grants time-limited access with manager approval and logs all activity.
   • BGive all employees access to all sensitive files to avoid delays.
   • CRemove the access control entirely and rely on the file server's permissions.
   • DKeep the current restriction and require employees to wait for the next quarterly access review.
   Reveal Solution Discussion Select an answer first