An organization has a mature control assurance framework, but recent audits show that the framework is not keeping pace with new cloud services and DevOps practices. The CISO wants to update the framework to address these changes while maintaining alignment with the existing risk appetite. Which approach best supports continuous improvement?

Conduct a targeted gap analysis of the framework against cloud and DevOps controls, then update the control catalog and assurance procedures

Wait for the next scheduled framework review in two years

Replace the framework with a new one that is designed for cloud environments

Add more frequent audits to catch issues earlier

What is the purpose of managing remediation actions after identifying control deficiencies?

To document that the deficiencies were found

To assign blame to the responsible individuals

To track and ensure that identified issues are resolved in a timely manner

To close the assurance engagement immediately

When selecting a control assurance framework, which factor is most important to consider first?

The number of controls in the framework

The framework's popularity in the industry

The organization's regulatory requirements and business objectives

The personal preference of the CISO

Which input is most valuable for driving continuous improvement of a control assurance framework?

The organization's marketing strategy

The number of security tools deployed

Results from recent control assurance audits and assessments

The personal opinions of the security team

An assurance team is planning to test the effectiveness of a change management control. The control requires that all production changes have an approved change request and a backout plan. The team has a list of all change requests from the past six months. Which testing procedure provides the strongest evidence that the control is operating effectively?

Interview the change manager about the approval process

Test all changes in the list for the presence of a backout plan only

Select a sample of changes and verify each has an approved request and backout plan

Review the change management policy to confirm it requires approvals and backout plans

EC-CouncilAssociate C|CISO

Domain 2Objective 3

Implementing Control Assurance Frameworks ACCISO Practice Questions (Page 4)

Part of the Information Security Controls and Audit Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 16–20

16expert · hard
An organization has a mature control assurance framework, but recent audits show that the framework is not keeping pace with new cloud services and DevOps practices. The CISO wants to update the framework to address these changes while maintaining alignment with the existing risk appetite. Which approach best supports continuous improvement?
Select an answer first
17foundation · easy
What is the purpose of managing remediation actions after identifying control deficiencies?
Select an answer first
18foundation · easy
When selecting a control assurance framework, which factor is most important to consider first?
Select an answer first
19foundation · easy
Which input is most valuable for driving continuous improvement of a control assurance framework?
Select an answer first
20application · medium
An assurance team is planning to test the effectiveness of a change management control. The control requires that all production changes have an approved change request and a backout plan. The team has a list of all change requests from the past six months. Which testing procedure provides the strongest evidence that the control is operating effectively?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Implementing Control Assurance Frameworks ACCISO Practice Questions (Page 4)

Questions 16–20

What is the purpose of managing remediation actions after identifying control deficiencies?

When selecting a control assurance framework, which factor is most important to consider first?

Which input is most valuable for driving continuous improvement of a control assurance framework?

Keep studying — Information Security Controls and Audit Management