Integrating Security Requirements into Operational Processes ACCISO Practice Questions (Page 13)

Questions 61–62

1. 61expert · hard

   A software company is developing a new customer-facing application. The product team wants to release a minimum viable product (MVP) quickly to gain market share. The security team wants to apply security-by-design principles, but the product team argues that full security integration will delay the release. What is the best compromise that maintains security-by-design?

   • AIdentify the minimum security requirements for the MVP and integrate them, deferring non-essential security features to later releases.
   • BRely on the development team's knowledge of secure coding practices.
   • CRelease the MVP without security features and add them in a future update.
   • DDelay the MVP release until all security features are implemented.
   Reveal Solution Discussion Select an answer first
2. 62expert · hard

   A multinational corporation is developing a new employee onboarding process. The security team must gather security requirements from various regions, each with different data protection laws. The legal team has provided a list of regional requirements, but they are conflicting in some areas. As the security manager, what is the best approach to reconcile these requirements?

   • ACreate separate security requirements for each region to meet local laws.
   • BUse the requirements from the region with the largest employee base.
   • CDevelop a single set of security requirements that meets the most stringent regional requirements.
   • DAsk the legal team to resolve the conflicts before proceeding.
   Reveal Solution Discussion Select an answer first