Integrating Security Requirements into Operational Processes ACCISO Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the core principle of security by design when applied to operational processes?

   • ASecurity is added only when a vulnerability is discovered
   • BSecurity is the sole responsibility of the security team
   • CSecurity is considered only after the process has been fully implemented
   • DSecurity requirements are embedded into the process from the outset
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A government agency is updating its procurement process. The legal department has provided data protection requirements, and a recent risk assessment identified a high risk of fraud in vendor payments. The agency needs to document security requirements for the new process. What is the most comprehensive approach?

   • AUse only the risk assessment findings to focus on the highest risks.
   • BUse only the legal requirements to avoid conflicting with regulations.
   • CCombine the legal requirements and risk assessment findings into a set of security requirements and map them to process steps.
   • DAsk the procurement team to suggest security measures based on their experience.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A manufacturing company is updating its production scheduling process to integrate with a new IoT sensor system. The change will affect how production data is collected and transmitted. The security team has identified that the new system will increase the attack surface. The operations team wants to implement the change quickly to improve efficiency. What should the security manager do?

   • AConduct a security risk assessment of the new system and implement compensating controls before deployment.
   • BDeploy the new system immediately and address security issues as they arise.
   • CRequire the operations team to sign a risk acceptance form.
   • DReject the change because it increases the attack surface.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A retail company is creating a new returns process. The legal team requires that returned items be inspected for data security (e.g., wiping personal data from returned devices). The operations team is unsure how to implement this. What is the first step to ensure security requirements are integrated?

   • AConduct a workshop with legal, operations, and IT to elicit and document the security requirements
   • BImmediately implement a data wiping procedure for all returned devices
   • CWait for a security incident to occur before defining requirements
   • DAsk the legal team to write a policy document without involving operations
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary goal of change management in the context of security integration?

   • ATo ensure that changes to operational processes do not weaken existing security controls
   • BTo implement all changes as quickly as possible without review
   • CTo prevent any changes to operational processes
   • DTo document changes only after they have been implemented
   Reveal Solution Discussion Select an answer first