Information Security Management Program ACCISO Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A healthcare organization's ISMP includes a risk register. During a quarterly review, the security team identifies a new vulnerability in the patient portal that could expose protected health information. The exploit is not yet publicly known, but the likelihood of internal misuse is moderate. What should the team do first to integrate this into the ISMP?

   • ADelete the risk from the register because the exploit is not publicly known
   • BWait until the next annual risk assessment to document the vulnerability
   • CReport the vulnerability only to the IT helpdesk and take no further action
   • DImmediately apply a compensating control and update the risk register with the new risk and treatment decision
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A financial institution is integrating risk management into its ISMP. The risk assessment identified a critical vulnerability in a legacy system that cannot be patched immediately. The system is essential for daily operations. The CISO must decide how to treat this risk while meeting regulatory requirements and minimizing business disruption. Which approach is most appropriate?

   • AImplement compensating controls, such as network segmentation and enhanced monitoring, and document the risk acceptance with a remediation timeline.
   • BReplace the legacy system immediately with a modern solution, regardless of cost and disruption.
   • CAccept the risk without any controls because the system is essential and cannot be changed.
   • DImmediately isolate the legacy system from the network to eliminate the vulnerability.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary difference between a security standard and a security guideline?

   • AStandards are mandatory, while guidelines are recommended
   • BStandards are for technical controls, while guidelines are for management
   • CStandards are written by external bodies, while guidelines are internal
   • DStandards are optional, while guidelines are mandatory
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A regional bank is updating its Information Security Management Program (ISMP) to support a new strategic goal of launching a mobile payments app within nine months. The CISO wants the ISMP to directly enable this business objective while still managing risk. Which approach best aligns the ISMP with the bank's strategy?

   • AConduct a focused risk assessment for the mobile payments feature and incorporate security requirements into the project's agile sprints
   • BFreeze all new security initiatives until the app is launched to avoid delaying the project
   • CAdopt a new industry security framework and require the app team to comply with all controls immediately
   • DOutsource the app's security testing to a third party and remove security tasks from the internal project plan
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After a significant security incident, a manufacturing company is reviewing its Information Security Management Program. The incident revealed gaps in incident response and third-party risk management. The CISO wants to ensure the program improves continuously. Which action is most aligned with a continuous improvement approach?

   • AConduct a post-incident review, update the risk assessment, and revise the ISMP policies and procedures accordingly.
   • BReplace the entire ISMP with a new framework to avoid repeating past mistakes.
   • CDocument the incident and move on, as the incident is already resolved.
   • DIncrease the security budget and purchase additional tools to prevent future incidents.
   Reveal Solution Discussion Select an answer first