After a control assurance assessment, the audit team identified a high-risk finding: firewall rules are not reviewed regularly. The CISO needs to report this finding and manage remediation. What is the most appropriate action for the CISO to take?

Wait until the next audit cycle to report the finding

Immediately change the firewall rules to align with the policy

Assign a remediation owner and set a deadline, but do not document the finding

Include the finding in the audit report with a recommendation to implement a quarterly firewall rule review

A company is implementing a control assurance framework and must integrate it with an existing GRC tool. The GRC tool currently tracks risks and incidents but not control testing. The CISO wants to avoid duplicate data entry and ensure that assurance findings are linked to risks. Which implementation approach best achieves this integration?

Keep control testing separate from the GRC tool to avoid complexity

Use a separate spreadsheet for control testing and manually update the GRC tool

Replace the GRC tool with a new one that includes control testing

Configure the GRC tool to store control definitions, testing results, and findings, and map them to existing risks

After a control assurance review, the audit team identified a high-severity finding: firewall rules are not reviewed quarterly as required by policy. The CISO wants to ensure the finding is addressed and tracked to closure. Which action should the CISO take to manage remediation effectively?

Update the firewall policy to remove the quarterly review requirement

Document the finding in the risk register and close it without action

Assign a remediation owner and set a target date, then track progress in a remediation register

Ask the audit team to re-test the control immediately

An assurance team is testing a control that requires all changes to production systems to be approved by the change advisory board (CAB). The team has a sample of 100 change requests. The control is considered effective if at least 95% of changes have documented approval. The team finds that 10 changes lack approval. What should the team do?

Conclude that the control is ineffective because the failure rate exceeds the threshold

Report the finding as a minor issue because only 10% failed

Recommend that the CAB approve the changes retroactively

Expand the sample to confirm the finding

During the implementation of a control assurance framework, what is the purpose of a gap analysis?

To replace all existing controls with new ones

To assign blame for past security failures

To calculate the total cost of the framework implementation

To identify differences between current controls and the framework's requirements

EC-CouncilAssociate C|CISO

Domain 2Objective 3

Implementing Control Assurance Frameworks ACCISO Practice Questions (Page 5)

Part of the Information Security Controls and Audit Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 21–25

21application · medium
After a control assurance assessment, the audit team identified a high-risk finding: firewall rules are not reviewed regularly. The CISO needs to report this finding and manage remediation. What is the most appropriate action for the CISO to take?
Select an answer first
22expert · hard
A company is implementing a control assurance framework and must integrate it with an existing GRC tool. The GRC tool currently tracks risks and incidents but not control testing. The CISO wants to avoid duplicate data entry and ensure that assurance findings are linked to risks. Which implementation approach best achieves this integration?
Select an answer first
23application · medium
After a control assurance review, the audit team identified a high-severity finding: firewall rules are not reviewed quarterly as required by policy. The CISO wants to ensure the finding is addressed and tracked to closure. Which action should the CISO take to manage remediation effectively?
Select an answer first
24expert · hard
An assurance team is testing a control that requires all changes to production systems to be approved by the change advisory board (CAB). The team has a sample of 100 change requests. The control is considered effective if at least 95% of changes have documented approval. The team finds that 10 changes lack approval. What should the team do?
Select an answer first
25foundation · easy
During the implementation of a control assurance framework, what is the purpose of a gap analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Implementing Control Assurance Frameworks ACCISO Practice Questions (Page 5)

Questions 21–25

After a control assurance assessment, the audit team identified a high-risk finding: firewall rules are not reviewed regularly. The CISO needs to report this finding and manage remediation. What is the most appropriate action for the CISO to take?

After a control assurance review, the audit team identified a high-severity finding: firewall rules are not reviewed quarterly as required by policy. The CISO wants to ensure the finding is addressed and tracked to closure. Which action should the CISO take to manage remediation effectively?

During the implementation of a control assurance framework, what is the purpose of a gap analysis?

Keep studying — Information Security Controls and Audit Management