Designing, Deploying, and Managing Security Controls ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A healthcare organization has implemented a new access control system that uses role-based access control (RBAC). Six months later, an audit reveals that several employees have access to patient records they no longer need. Which lifecycle phase was most likely neglected?

   • ADesign, because the RBAC roles were not defined with least privilege in mind.
   • BAssessment, because the organization did not evaluate the effectiveness of the RBAC system before deployment.
   • CImplementation, because the RBAC system was not configured correctly from the start.
   • DMonitoring and maintenance, because access rights were not reviewed and updated as job roles changed.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A financial institution has implemented a new fraud detection system. The system uses machine learning to identify suspicious transactions. After six months, the system is generating a high number of false positives, causing legitimate transactions to be declined and customers to complain. The CISO wants to reduce false positives without increasing the risk of missing actual fraud. What is the best approach?

   • ADisable the fraud detection system until the model is retrained.
   • BIncrease the threshold to reduce false positives, even if it means missing some fraudulent transactions.
   • CAdjust the machine learning model's threshold to reduce false positives, and monitor the impact on fraud detection.
   • DReplace the machine learning model with a rule-based system that has fewer false positives.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A regional bank is rolling out a new customer-facing web portal. The security team must ensure that even if an attacker compromises the web server, they cannot directly access the backend database. The portal will be deployed in phases, starting with a pilot for internal users. Which control design principle should guide the network architecture, and how should the deployment begin?

   • APlace the web server in a DMZ and the database in a separate internal subnet with firewall rules allowing only the web server to connect; start with the pilot phase.
   • BPut the web server and database on the same subnet to simplify management; deploy to all users at once to speed up the rollout.
   • CUse a single firewall to protect both the web server and database, and deploy the portal to all customers immediately after a brief internal test.
   • DPlace the database in the DMZ with the web server to reduce latency; start with a pilot for internal users.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which activity is an example of optimizing a security control after an assessment reveals it is not performing effectively?

   • AAdjusting the control's configuration to better align with the threat environment
   • BDocumenting the assessment results in a report
   • CDeleting the control because it is not working
   • DIgnoring the findings to avoid additional work
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A healthcare organization has implemented a new data loss prevention (DLP) system. Six months after deployment, the security team notices that the DLP is generating a high volume of false positives, causing staff to ignore alerts. The CISO wants to improve the effectiveness of the control. What should the security team do first?

   • AReview and tune the DLP policies and rules based on the false positive patterns.
   • BImmediately increase the severity level of all DLP alerts to ensure they are noticed.
   • CReplace the DLP system with a different vendor product that promises fewer false positives.
   • DDisable the DLP system until the false positive issue is resolved.
   Reveal Solution Discussion Select an answer first