Information Security Projects ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security program manager is reporting to the board on a security awareness project. The board wants to understand the project's impact on reducing human-related security incidents. Which reporting approach would be most effective?

   • AReport the number of training sessions conducted and the total training hours.
   • BReport the budget spent on the training program.
   • CReport the number of security incidents that occurred during the project period.
   • DReport the percentage of employees who completed training and the trend in phishing simulation failure rates.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During the execution of a security awareness training project, the project manager notices that the completion rate for mandatory training modules is significantly below the target. What is the most appropriate control action?

   • AExtend the project deadline to allow more time for completion.
   • BImmediately escalate the issue to the steering committee without further investigation.
   • CAnalyze the root cause of low completion and adjust the training delivery method or schedule.
   • DLower the target completion rate to match the current progress.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A regional bank is planning a multi-year rollout of a new customer authentication platform. The project sponsor has mandated a fixed go-live date because of regulatory deadlines, but the security team has identified that the current vendor integration timeline is uncertain. The project manager must develop a plan that balances the fixed date with the security team's concerns. Which approach best addresses this constraint?

   • ABuild a risk-adjusted schedule with buffer time for vendor integration and define a contingency plan if the date slips.
   • BEscalate the vendor uncertainty to the steering committee and ask them to change the regulatory deadline.
   • CRemove the security integration tasks from the critical path so the go-live date is met without security delays.
   • DLock the schedule and require the security team to accept the vendor's timeline as-is to meet the regulatory date.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security project to implement a new vulnerability management program is in its execution phase. The project manager must report to the steering committee, which includes executives who are not technical. Which set of metrics would be most effective for this audience?

   • ANumber of vulnerabilities discovered, average CVSS score, and patch deployment rate.
   • BPercentage of critical systems covered, reduction in high-risk vulnerabilities, and overall risk score trend.
   • CTotal hours spent scanning, number of scans completed, and tool uptime.
   • DNumber of security incidents avoided, which is estimated from historical data.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security project to implement a new identity management system is experiencing delays. The project manager needs to inform stakeholders and decide on corrective action. Which governance mechanism should be used to address the delay?

   • AConvene the steering committee to review the delay, assess options, and approve a revised plan.
   • BSend a status report to all stakeholders and continue with the current plan.
   • CInform the project sponsor and ask for more budget without a detailed analysis.
   • DUpdate the project plan quietly and inform stakeholders only at the next scheduled report.
   Reveal Solution Discussion Select an answer first