Information Security Management Program ACCISO Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A logistics company is integrating risk management into its ISMP. The risk assessment identified that a key supplier has weak security practices, posing a risk to the company's supply chain. The company wants to continue using the supplier due to cost advantages. Which risk treatment option is most appropriate?

   • AAccept the risk because the supplier is cost-effective and the risk is unlikely to materialize.
   • BMitigate the risk by requiring the supplier to implement specific security controls and monitoring their compliance.
   • CAvoid the risk by terminating the supplier relationship immediately.
   • DTransfer the risk by signing a contract that holds the supplier liable for any security breach.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A software development company's ISMP includes a policy on secure coding. The security team wants to provide developers with recommended, but not mandatory, best practices for code review. Which document type should they use?

   • AA guideline that suggests best practices for code review
   • BA standard that mandates specific code review tools
   • CA procedure that details step-by-step code review steps
   • DA new policy on secure coding
   Reveal Solution Discussion Select an answer first
4. 38expert · medium

   A company is expanding into a new market with strict data protection regulations. The CISO must update the ISMP to comply while maintaining the company's existing global standards. The company's current policies are based on a less restrictive framework. Which approach best balances compliance with global consistency?

   • ADelay updating the global policies until the new market's regulations are fully understood.
   • BAdopt the stricter regulatory requirements as the baseline for global policies, and allow regional variations only where they are more stringent.
   • CCreate entirely separate policies for each market to ensure local compliance.
   • DKeep the current global policies and add a separate policy for the new market to meet local regulations.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A university is developing an information security policy framework. The IT department wants to enforce strong password requirements, but faculty members are resisting due to inconvenience. The CISO needs to ensure the policy is adopted while addressing concerns. Which approach is most effective?

   • AInvolve faculty representatives in the policy development process and provide training on the reasons for the requirements.
   • BImplement the policy only for IT staff and exempt faculty to maintain goodwill.
   • CMandate the policy with strict enforcement and penalties for non-compliance.
   • DMake the password policy a guideline rather than a mandatory policy to avoid conflict.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which risk treatment option involves implementing controls to reduce the likelihood or impact of a risk?

   • ARisk acceptance
   • BRisk avoidance
   • CRisk transfer
   • DRisk mitigation
   Reveal Solution Discussion Select an answer first