Information Security Management Program ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm has experienced multiple phishing incidents despite having a security awareness program. The CISO wants to redesign the training to be more effective. The firm has a diverse workforce including remote employees and non-technical staff. Which approach is most likely to improve the program's effectiveness?

   • ADeliver role-based training that includes simulated phishing exercises and provides immediate feedback to employees.
   • BIncrease the frequency of the same annual training course to ensure employees remember the content.
   • CFocus only on technical staff, since they are the primary target of phishing attacks.
   • DReplace training with a strict technical email filtering solution to block all phishing emails.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A healthcare organization is integrating risk management into its Information Security Management Program. After a recent risk assessment, several high-risk vulnerabilities were identified in the patient portal. The CISO must decide how to treat these risks while balancing budget constraints and patient safety. Which action best demonstrates effective risk treatment within the ISMP?

   • AImplement compensating controls to reduce the likelihood and impact of exploitation, and document the residual risk for ongoing monitoring.
   • BAccept the risk without further action because the portal is essential for patient access and the budget is limited.
   • CTransfer the risk by purchasing cyber insurance, and then ignore the vulnerabilities.
   • DImmediately shut down the patient portal until all vulnerabilities are fully patched, regardless of patient impact.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In an information security policy framework, which document typically provides the highest-level direction and is approved by senior management?

   • APolicy
   • BProcedure
   • CStandard
   • DGuideline
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization's ISMP policy framework includes a policy on acceptable use of company devices. The security team wants to ensure that employees understand the specific steps to report a lost device. Which document should be updated or created?

   • AA standard that defines the mandatory reporting timeline
   • BA procedure that outlines the step-by-step process for reporting a lost device
   • CA new policy on device loss reporting
   • DA guideline that suggests optional reporting methods
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is it important to report ISMP metrics to stakeholders?

   • ATo replace the need for internal audits
   • BTo justify the need for more security staff
   • CTo satisfy the requirements of every regulatory framework
   • DTo demonstrate the value and effectiveness of the security program
   Reveal Solution Discussion Select an answer first