Integrating Security Requirements into Operational Processes ACCISO Practice Questions (Page 12)

Questions 56–60

1. 56expert · hard

   A telecommunications company is updating its customer support process to include a new CRM system. The security team has identified that the new system must integrate with the existing single sign-on (SSO) infrastructure. The operations team is concerned about downtime during the transition. What is the best way to manage this change without compromising security?

   • AAllow the operations team to manage the change without involving the security team
   • BDevelop a detailed change plan that includes security testing, rollback procedures, and a phased rollout
   • CImplement the new system immediately and address any security issues after it goes live
   • DSkip the SSO integration to avoid any potential downtime
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   A retail chain is upgrading its point-of-sale (POS) system. The new system will process credit card payments and integrate with a loyalty program. The security team is concerned about maintaining PCI DSS compliance during the transition. What should the security manager do?

   • ARely on the vendor's assurance that the new system is PCI compliant.
   • BTemporarily disable the loyalty program integration to reduce risk.
   • CConduct a security audit after the upgrade is complete.
   • DInclude PCI DSS requirements in the change management plan and validate them before and after the upgrade.
   Reveal Solution Discussion Select an answer first
4. 58application · medium

   A manufacturing company is implementing a new supplier onboarding process. The legal department requires that all suppliers sign a data protection agreement, and the IT department requires that suppliers be provisioned with least-privilege access to the company's portal. The process owner asks you to document these requirements. What is the most effective way to capture them?

   • ACreate a security requirements checklist that is attached to the process workflow and reviewed during process design
   • BVerbally communicate the requirements during a team meeting
   • CSend an email to the process owner summarizing the requirements
   • DWait until the process is implemented and then test for compliance
   Reveal Solution Discussion Select an answer first
5. 59application · medium

   A logistics company is designing a new package tracking process. The security team wants to ensure that security requirements are integrated throughout the entire operational process lifecycle. At which stages should security requirements be considered?

   • AOnly during the planning stage to avoid constraining the design.
   • BDuring the review stage only, to assess what went wrong.
   • COnly during the execution stage to focus on operational controls.
   • DDuring planning, execution, and review stages to ensure continuous coverage.
   Reveal Solution Discussion Select an answer first
6. 60application · medium

   A logistics company is migrating its tracking system to a cloud-based platform. The security team has integrated security requirements into the current on-premises process. What should the security manager do to ensure security requirements are maintained during the migration?

   • ADisable the old system once the new one is live to reduce complexity.
   • BUpdate the security requirements to reflect the cloud environment and validate them in the new process.
   • CRely on the cloud provider's security certifications to ensure compliance.
   • DKeep the same security requirements without changes, as they are already integrated.
   Reveal Solution Discussion Select an answer first