Integrating Security Requirements into Operational Processes ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational corporation is implementing a new ERP system that will replace several legacy systems. The change will affect finance, HR, and supply chain processes. The security team has integrated security requirements into the existing processes. The project timeline is tight, and the business wants to minimize disruption. What is the best approach to manage this change while maintaining security?

   • ARely on the ERP vendor's security certifications to ensure compliance.
   • BDefer security validation until after the system is fully deployed.
   • CConduct a phased rollout, validating security controls at each phase before proceeding.
   • DPerform a full cutover to the new system to minimize the transition period.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A fintech startup is building a new mobile payment application. The product team wants to launch quickly, but the security team insists on integrating security from the start. Which action best exemplifies security-by-design?

   • APlan to add security features after the first release to meet the launch deadline.
   • BHire a security consultant to review the code after development is complete.
   • CUse a secure development framework, but only for the payment processing module.
   • DInclude security requirements in the initial design and development sprints.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How does continuous improvement relate to the monitoring of integrated security measures?

   • AContinuous improvement is a one-time activity after implementation
   • BContinuous improvement replaces the need for monitoring
   • CMonitoring data is used to identify weaknesses and drive improvements
   • DMonitoring is only needed when a security incident occurs
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A healthcare organization has implemented a new patient data access process with integrated security controls. The security team is tasked with establishing a monitoring mechanism to verify that controls are effective. The organization has limited resources and cannot afford expensive monitoring tools. What is the most cost-effective approach that still provides meaningful assurance?

   • ARely on employee self-reporting of any security incidents.
   • BUse existing logging and auditing capabilities to track access and review them regularly.
   • CConduct manual audits of the process every six months.
   • DPurchase a commercial SIEM solution to automate monitoring.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial services company is mapping its loan approval process. The process includes credit check, risk assessment, approval, and disbursement. The security team has identified that the credit check step involves transmitting sensitive customer data to a third-party bureau. What control should be implemented at that step?

   • AStore the credit check data in an encrypted database.
   • BRequire dual approval for all loan applications.
   • CEncrypt the data in transit and verify the third party's security posture.
   • DConduct regular audits of the loan approval process.
   Reveal Solution Discussion Select an answer first