Information Security Projects ACCISO Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security project to implement a new encryption standard is facing a conflict between the project's quality requirements and its schedule. The security team wants to conduct extensive testing to ensure no data corruption, but the business sponsor wants to meet a market-driven launch date. What is the most appropriate way to resolve this conflict?

   • APresent the trade-off between quality and schedule to the steering committee and let them make an informed decision.
   • BReduce the testing scope to meet the launch date and accept the risk of data corruption.
   • CExtend the schedule to allow full testing, and communicate the delay to the sponsor.
   • DProceed with full testing and hope the launch date can be adjusted later.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of an internal stakeholder in a security project?

   • AA security vendor
   • BAn external auditor
   • CA regulatory agency
   • DThe organization's IT department
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security program manager is reporting on a vulnerability management project to the executive steering committee. Which metric would best demonstrate the project's effectiveness in reducing organizational risk?

   • ANumber of vulnerabilities discovered in the last quarter.
   • BTotal hours spent on vulnerability scanning.
   • CPercentage of critical vulnerabilities remediated within the agreed SLA.
   • DNumber of security team meetings held per month.
   Reveal Solution Discussion Select an answer first
5. 19application · medium · select all that apply

   A security project to implement a new SIEM is being overseen by a steering committee. Which of the following are appropriate responsibilities of the steering committee? (Select all that apply.)

   • AProvide strategic direction and ensure alignment with organizational goals.
   • BReview project status reports and resolve escalated issues.
   • CPerform daily project tasks such as configuring the SIEM.
   • DDevelop the detailed project schedule and assign tasks to team members.
   • EApprove changes to the project scope and budget.
   Check answers Discussion Select an answer first
6. 20application · medium

   A security project to implement a new encryption standard has a fixed completion date because of a compliance deadline. The project sponsor asks the project manager to add an additional scope item that would enhance security but is not required for compliance. What should the project manager do first?

   • ARefuse the request because the project is already fixed in scope.
   • BImmediately add the new scope item to the project plan to satisfy the sponsor.
   • CAssess the impact of the additional scope on time, cost, and quality, and present the trade-offs to the sponsor.
   • DAsk the compliance auditor for permission to extend the deadline.
   Reveal Solution Discussion Select an answer first