Implementing Control Assurance Frameworks ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A government agency must comply with FISMA and wants to adopt a control assurance framework. The agency has a mature risk management process and needs a framework that aligns with NIST guidance. The agency also wants to avoid duplicating existing risk management efforts. Which framework should the agency select?

   • ANIST Cybersecurity Framework
   • BCIS Controls
   • CCOBIT 2019
   • DISO/IEC 27001
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of a control assurance framework in an organization?

   • ATo replace the need for internal audits by providing a one-time certification
   • BTo automatically enforce all security policies without human intervention
   • CTo define the organization's business strategy and market positioning
   • DTo provide a structured approach for validating that security controls operate effectively and meet defined objectives
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which statement best describes the role of control assurance frameworks in relation to information security controls?

   • AThey guarantee that all security incidents will be prevented
   • BThey are mandatory for all organizations regardless of industry
   • CThey provide a systematic way to assess whether controls are implemented and functioning as intended
   • DThey focus solely on technical controls and ignore procedural controls
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An internal audit team is testing the effectiveness of a new access recertification control. The control requires managers to review and approve user access quarterly. The team has a sample of 50 access reviews. Which evidence collection method provides the most reliable evidence that the control is operating effectively?

   • AReviewing the access review reports and verifying that all 50 reviews were completed and approved
   • BReviewing the access control policy document
   • CObserving one manager performing a review
   • DInterviewing managers about their understanding of the recertification process
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A large hospital is implementing a control assurance framework to comply with HIPAA and state privacy laws. The hospital has a decentralized IT structure with each department managing its own access controls. The CISO has limited budget and must minimize disruption to clinical operations. What is the most effective approach to implement the framework?

   • AOutsource the implementation to a third-party consultant
   • BConduct a gap analysis and prioritize remediation based on risk
   • CImplement a centralized access control policy and enforce it through the framework
   • DAdopt a framework that requires minimal changes to existing processes
   Reveal Solution Discussion Select an answer first