An assurance team must test the effectiveness of a control that requires all privileged access requests to be approved by a manager. The team has a list of 10,000 privileged access requests from the past year. The team has limited time and must provide a high level of assurance. The control is considered high-risk. Which testing approach is most appropriate?

Use statistical sampling to select a representative sample and test each for approval evidence

Test only the requests from the last month

Test all 10,000 requests to achieve 100% assurance

Interview the managers who approve requests

Which of the following is a key component of the ISO/IEC 27001 standard?

A set of mandatory technical controls that must all be implemented

A framework focused exclusively on cloud security

A framework for establishing, implementing, maintaining, and continually improving an information security management system (ISMS)

A certification for individual security professionals

An internal audit team is executing a control assurance review of the access management process. The team has limited time and must test whether terminated employees' accounts are disabled within the required 24-hour SLA. Which evidence collection method provides the most reliable and efficient assurance for this control?

Run a data analytics query comparing HR termination records to active account timestamps

Review the access management policy document

Interview the access management team about their termination procedures

Inspect a sample of user access review reports from the last quarter

EC-CouncilAssociate C|CISO

Domain 2Objective 3

Implementing Control Assurance Frameworks ACCISO Practice Questions (Page 8)

Part of the Information Security Controls and Audit Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

Questions 36–40

36foundation · easy
Which framework is specifically designed for IT governance and aligns IT objectives with business goals?
Select an answer first
37expert · hard
An assurance team must test the effectiveness of a control that requires all privileged access requests to be approved by a manager. The team has a list of 10,000 privileged access requests from the past year. The team has limited time and must provide a high level of assurance. The control is considered high-risk. Which testing approach is most appropriate?
Select an answer first
38foundation · easy
Which of the following is a key component of the ISO/IEC 27001 standard?
Select an answer first
39application · medium
An internal audit team is executing a control assurance review of the access management process. The team has limited time and must test whether terminated employees' accounts are disabled within the required 24-hour SLA. Which evidence collection method provides the most reliable and efficient assurance for this control?
Select an answer first
40expert · hard
A multinational corporation is considering adopting a control assurance framework. The corporation has operations in the EU, the US, and Asia, and must comply with GDPR, SOX, and local data protection laws. The CISO wants a framework that can be certified, supports continuous improvement, and can be mapped to multiple regulatory requirements. Which framework should the CISO select?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Implementing Control Assurance Frameworks ACCISO Practice Questions (Page 8)

Questions 36–40

Which framework is specifically designed for IT governance and aligns IT objectives with business goals?

Which of the following is a key component of the ISO/IEC 27001 standard?

Keep studying — Information Security Controls and Audit Management