Implementing Control Assurance Frameworks ACCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A small e-commerce startup needs to demonstrate compliance with PCI DSS and wants a control assurance framework that is cost-effective and easy to implement. The company has no dedicated compliance staff and uses a cloud-based infrastructure. Which framework should the startup select?

   • ACOBIT 2019
   • BISO 27001
   • CCIS Controls
   • DNIST Cybersecurity Framework
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company has been using a control assurance framework for three years. The latest audit shows that the framework is not keeping pace with new cloud-based services the company has adopted. The CISO wants to update the framework but has limited resources. What is the most effective approach?

   • AReplace the entire framework with a cloud-specific framework
   • BConduct a targeted risk assessment for the new cloud services and update only the affected controls
   • CAdd new controls for every cloud service without assessing risk
   • DWait until the next annual audit to update the framework
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the main objective of reporting control assurance findings?

   • ATo communicate the effectiveness of controls and any deficiencies to stakeholders
   • BTo justify the budget for the assurance team
   • CTo publicly disclose all security vulnerabilities
   • DTo replace the need for remediation actions
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization's control assurance framework has been in place for two years. The latest audit results show that the same control deficiency has been reported in three consecutive audits, despite remediation efforts. The CISO wants to determine why the deficiency persists. Which action is most appropriate?

   • APerform a root cause analysis to identify underlying process or design issues
   • BAssume the control is not important and deprioritize it
   • CIncrease the severity rating of the finding to escalate it
   • DRemove the control from the framework to eliminate the finding
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company has completed its first full year of using a control assurance framework. The audit results show that most controls are effective, but a few have recurring deficiencies. The CISO wants to improve the framework. What should the CISO do?

   • AReplace the framework with a different one
   • BIgnore the recurring deficiencies if they are low risk
   • CIncrease the frequency of audits for all controls
   • DAnalyze the root causes of the recurring deficiencies and adjust the framework accordingly
   Reveal Solution Discussion Select an answer first