A financial services firm has a security control that requires all employees to use a hardware token for VPN access. The control is effective, but employees complain that the tokens are inconvenient and often forgotten, leading to lost productivity. The CISO wants to maintain security while improving user satisfaction. What is the best course of action?

Remove the hardware token requirement and rely on passwords only.

Evaluate alternative multi-factor authentication methods, such as push-based mobile authentication, and pilot them with a small group.

Issue two tokens to each employee to reduce the chance of forgetting.

Keep the hardware tokens but provide additional training to employees.

A company has a security control that requires all employees to use a VPN when accessing internal resources remotely. The control is effective, but employees complain that the VPN is slow and often disconnects. The CISO wants to maintain security while improving user experience. What is the best approach?

Implement a split-tunnel VPN so that only traffic to internal resources goes through the VPN.

Keep the VPN but upgrade the VPN concentrator hardware to improve performance.

Remove the VPN requirement and allow employees to access internal resources directly from their home networks.

Replace the VPN with a zero-trust network access (ZTNA) solution that provides granular access to specific applications.

EC-CouncilAssociate C|CISO

Domain 2Objective 1

Designing, Deploying, and Managing Security Controls ACCISO Practice Questions (Page 8)

Part of the Information Security Controls and Audit Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 36–37

36expert · hard
A financial services firm has a security control that requires all employees to use a hardware token for VPN access. The control is effective, but employees complain that the tokens are inconvenient and often forgotten, leading to lost productivity. The CISO wants to maintain security while improving user satisfaction. What is the best course of action?
Select an answer first
37application · medium
A company has a security control that requires all employees to use a VPN when accessing internal resources remotely. The control is effective, but employees complain that the VPN is slow and often disconnects. The CISO wants to maintain security while improving user experience. What is the best approach?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Designing, Deploying, and Managing Security Controls ACCISO Practice Questions (Page 8)

Questions 36–37

Keep studying — Information Security Controls and Audit Management