Designing, Deploying, and Managing Security Controls ACCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company has implemented a new data loss prevention (DLP) system. After a few months, the security team wants to ensure that the DLP rules are still effective and that they do not block legitimate business processes. What should the team do?

   • ALeave the DLP rules unchanged to avoid any potential disruption.
   • BReview DLP incident reports and adjust rules based on false positives and business feedback.
   • CDisable the DLP system and rely on user training.
   • DIncrease the sensitivity of the DLP rules to catch more data exfiltration attempts.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company has implemented a security control that requires all employees to use a hardware token for two-factor authentication (2FA). The control is effective, but the company is expanding rapidly and the cost of purchasing and distributing hardware tokens is becoming unsustainable. The CISO wants to maintain the same level of security while reducing costs. What is the best approach?

   • AImplement a risk-based authentication system that requires 2FA only for high-risk transactions.
   • BRemove the 2FA requirement for low-risk employees to reduce costs.
   • CSwitch to a mobile-based authenticator app for all employees.
   • DKeep the hardware tokens but negotiate a bulk discount with the vendor.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   A security architect is designing access controls for a new system. The principle of least privilege requires that users be granted:

   • AAccess to all resources in the organization for maximum flexibility
   • BThe same access level as their supervisor to ensure efficiency
   • COnly the permissions necessary to perform their job functions
   • DAdministrative rights by default to avoid access issues
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A multinational corporation is deploying a new endpoint detection and response (EDR) tool. The security team has limited resources and wants to ensure that the deployment does not disrupt business operations. The company has offices in different time zones. Which deployment approach is most appropriate?

   • ADeploy the EDR only to endpoints in the headquarters office first, then to all other offices at once.
   • BDeploy the EDR to all endpoints in the highest-risk regions first, then to the rest of the company.
   • CDeploy the EDR in phases, starting with a pilot group, then rolling out by business unit and time zone.
   • DDeploy the EDR to all endpoints simultaneously during a weekend maintenance window.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In the security control management lifecycle, which activity is typically performed during the maintenance phase?

   • ADecommissioning the control after its useful life
   • BConducting a risk assessment for a new system
   • CApplying patches and updates to the control software
   • DReviewing audit logs for suspicious activity
   Reveal Solution Discussion Select an answer first