Information Security Management Program ACCISO Practice Questions (Page 7)

Questions 31–35

1. 31expert · medium

   A company's ISMP includes a risk management process that is separate from the business planning process. As a result, security risks are not considered when new projects are initiated. The CISO wants to integrate risk management into the ISMP more effectively. Which action is most likely to achieve this integration?

   • AConduct an annual enterprise-wide risk assessment and share the results with project managers.
   • BDevelop a risk register and ask project managers to update it at the end of each project.
   • CRequire a security risk assessment as part of the project initiation phase for all new initiatives, with results reviewed by the security team.
   • DCreate a separate risk management team that reviews projects after they are launched.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is an example of a key performance indicator (KPI) for an ISMP?

   • ANumber of servers in the data center
   • BPercentage of employees who completed security awareness training
   • CAverage employee salary
   • DTotal IT budget in dollars
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A manufacturing company's ISMP includes a risk management process. The company is considering adopting a new industrial IoT system that will improve efficiency but introduces significant cybersecurity risks. The CISO must decide how to integrate this into the ISMP. Which approach is most balanced?

   • AReject the IoT system because the risks are too high
   • BTransfer all risks to the IoT vendor through contractual agreements
   • CImplement the IoT system with a risk treatment plan that includes segmentation, monitoring, and vendor security requirements
   • DAccept the risks and proceed with the IoT system without additional controls
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A government agency is required to provide security awareness training to all employees. The training must be accessible to employees with disabilities and available in multiple languages. The agency also needs to track completion for compliance reporting. Which approach best meets these requirements?

   • ADevelop an e-learning module that is WCAG-compliant, available in the required languages, and integrated with a learning management system (LMS) for tracking.
   • BSend a PDF document to all employees and ask them to confirm receipt via email.
   • CConduct in-person training sessions with translated materials and paper sign-in sheets.
   • DProvide training only in English and rely on supervisors to ensure their staff understand the material.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which continuous improvement methodology is commonly used to review and enhance an ISMP?

   • AWaterfall model
   • BSix Sigma
   • CPlan-Do-Check-Act (PDCA)
   • DAgile Scrum
   Reveal Solution Discussion Select an answer first