Integrating Security Requirements into Operational Processes ACCISO Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A university is developing a new online course registration system. The security team wants to ensure that student data is protected from the start. Which practice best reflects security-by-design?

   • ARelying on the hosting provider's security measures without additional controls
   • BConducting a security audit only after the system is fully operational
   • CIncluding data protection requirements in the system design specifications and conducting security reviews during development
   • DAdding security features after the system is deployed based on user feedback
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which practice best exemplifies security by design in the development of a new operational process?

   • AAdding security controls only after a security incident occurs
   • BDocumenting security requirements but not implementing them until later
   • CConducting a security risk assessment during the requirements and design phase
   • DWaiting for the process to be deployed and then hiring a penetration tester
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A financial institution has integrated security controls into its loan origination process. The security team is responsible for monitoring and continuous improvement. The institution is facing budget cuts, and the security team must reduce monitoring costs without significantly reducing assurance. What is the most effective approach?

   • APrioritize monitoring of high-risk steps and automate alerts for anomalies.
   • BOutsource monitoring to a third-party provider.
   • CEliminate monitoring and rely on incident reports.
   • DReduce the frequency of monitoring to quarterly reviews.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A hospital is mapping its patient referral process, which involves multiple departments and external specialists. The security team has identified that patient data is shared with external specialists via email, which is insecure. The hospital wants to maintain efficiency while ensuring data security. What control should be implemented?

   • AContinue using email but require the sender to encrypt the email.
   • BUse a courier service to deliver physical copies of patient data.
   • CProhibit the sharing of patient data with external specialists.
   • DImplement a secure file-sharing platform with encryption and access controls for sharing patient data.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which activity is part of security requirements elicitation?

   • AInterviewing stakeholders to understand their security needs and expectations
   • BDeploying security patches to production systems
   • CConfiguring firewall rules to block unauthorized traffic
   • DMonitoring network traffic for anomalies
   Reveal Solution Discussion Select an answer first