A software company is adopting a DevOps model to accelerate feature delivery. The security team wants to embed security into the CI/CD pipeline. Which approach best reflects security-by-design principles?

Perform a security review after each release to identify issues for the next sprint.

Add a manual security gate before production deployment to catch any issues.

Train developers on secure coding and rely on their adherence to best practices.

Integrate automated security scanning tools into the pipeline and require them to pass before deployment.

A bank is mapping its wire transfer process. The process includes authentication, authorization, transaction execution, and confirmation. The security team has identified that the authorization step lacks segregation of duties. What control should be implemented at that step?

Encrypt the wire transfer data in transit.

Monitor wire transfers after execution for anomalies.

Add an extra authentication factor for all wire transfers.

Require dual approval from two different authorized employees for transfers above a threshold.

A technology company is adopting a microservices architecture for its application. The security team wants to apply security-by-design principles. The development team is concerned that adding security to each microservice will slow down development. What is the best way to balance security and development speed?

Use a single security gateway for all microservices.

Require each microservice team to implement its own security controls independently.

Implement a security framework that provides common security controls as a shared service.

Defer security implementation until after the microservices are deployed.

An e-commerce company has integrated security requirements into its order fulfillment process, including encryption of customer data and access controls for warehouse staff. How should the company verify that these security requirements are being met on an ongoing basis?

Implement automated monitoring that checks encryption settings and access logs, with alerts for anomalies

Review the process documentation every six months

Conduct a one-time audit at the end of the fiscal year

Rely on customer complaints to identify security failures

EC-CouncilAssociate C|CISO

Domain 3Objective 3

Integrating Security Requirements into Operational Processes ACCISO Practice Questions (Page 3)

Part of the Security Program Management and Operations domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

7concepts

Questions 11–15

11foundation · easy
Which stage of the operational process lifecycle is most appropriate for conducting a post-implementation review of security requirements?
Select an answer first
12application · medium
A software company is adopting a DevOps model to accelerate feature delivery. The security team wants to embed security into the CI/CD pipeline. Which approach best reflects security-by-design principles?
Select an answer first
13application · medium
A bank is mapping its wire transfer process. The process includes authentication, authorization, transaction execution, and confirmation. The security team has identified that the authorization step lacks segregation of duties. What control should be implemented at that step?
Select an answer first
14expert · hard
A technology company is adopting a microservices architecture for its application. The security team wants to apply security-by-design principles. The development team is concerned that adding security to each microservice will slow down development. What is the best way to balance security and development speed?
Select an answer first
15application · medium
An e-commerce company has integrated security requirements into its order fulfillment process, including encryption of customer data and access controls for warehouse staff. How should the company verify that these security requirements are being met on an ongoing basis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.

Integrating Security Requirements into Operational Processes ACCISO Practice Questions (Page 3)

Questions 11–15

Which stage of the operational process lifecycle is most appropriate for conducting a post-implementation review of security requirements?

A software company is adopting a DevOps model to accelerate feature delivery. The security team wants to embed security into the CI/CD pipeline. Which approach best reflects security-by-design principles?

A bank is mapping its wire transfer process. The process includes authentication, authorization, transaction execution, and confirmation. The security team has identified that the authorization step lacks segregation of duties. What control should be implemented at that step?

An e-commerce company has integrated security requirements into its order fulfillment process, including encryption of customer data and access controls for warehouse staff. How should the company verify that these security requirements are being met on an ongoing basis?

Keep studying — Security Program Management and Operations