Information Security Management Program ACCISO Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A financial institution's ISMP has been in place for three years. A recent internal audit found that the risk register is not updated regularly, and several new business units have not been included in the risk assessment process. The CISO must improve the ISMP. Which action is most effective?

   • ARequire all business units to submit risk assessments annually
   • BIntegrate risk assessment updates into the existing quarterly business review cycle
   • CCreate a standalone risk management team to handle all risk assessments
   • DIncrease the frequency of internal audits to catch missed updates
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   After a security incident, a logistics company's ISMP review reveals that the incident response plan was not followed because the plan was outdated and did not include new cloud-based systems. The CISO wants to apply continuous improvement. What should be the first step?

   • AReplace the entire ISMP with a new framework to prevent future issues
   • BBlame the incident response team for not following the plan
   • CIncrease the frequency of security audits without updating the plan
   • DUpdate the incident response plan to include cloud systems and conduct a post-incident review with lessons learned
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A multinational corporation's ISMP includes a risk management process. The company operates in a region with strict data residency laws, and a new cloud service provider (CSP) offers a cost-effective solution but stores data in a country that does not meet the residency requirement. The CISO must decide how to proceed while integrating risk management into the ISMP. Which approach best balances cost, compliance, and risk?

   • AUse the CSP but encrypt all data before transmission to mitigate the residency risk
   • BSelect a different CSP that offers a data center in the required region, even if it costs more
   • CAccept the risk and use the CSP because the cost savings are significant
   • DStore the data on-premises and avoid cloud services entirely
   Reveal Solution Discussion Select an answer first
5. 44expert · medium

   A large enterprise is revising its security policy framework. The CISO wants to ensure that policies are not just documents but are actively used in daily operations. The company has a high turnover rate and a remote workforce. Which approach is most likely to embed policies into the organization's culture?

   • ACreate a single comprehensive policy document that covers all requirements to simplify communication.
   • BIntegrate policy requirements into onboarding, regular training, and performance evaluations, and provide easy access to policies via an internal portal.
   • CPublish the policies on the company intranet and require employees to acknowledge them annually.
   • DRely on managers to communicate policies to their teams as needed.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A global company's ISMP includes a security awareness program. The program currently offers training only in English, but a significant portion of the workforce speaks Spanish or Mandarin. The CISO wants to improve the program's reach and effectiveness. What is the most appropriate action?

   • AKeep the training in English and rely on written translations of the policy
   • BOnly train employees who speak English and exclude others
   • CTranslate the training materials into the primary languages of the workforce
   • DRequire all employees to learn English before taking the training
   Reveal Solution Discussion Select an answer first