Integrating Security Requirements into Operational Processes ACCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A government agency is developing a new benefits eligibility process. The security team needs to gather security requirements from multiple stakeholders. Which stakeholder is most likely to provide requirements related to data privacy?

   • AThe legal and compliance department.
   • BThe external auditor.
   • CThe marketing department.
   • DThe IT help desk team.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A telecommunications company is mapping its customer service process, which includes identity verification, account access, and service changes. The security team has identified that identity verification is weak and prone to social engineering. What is the best way to mitigate this risk at that process step?

   • ATrain customer service representatives to recognize social engineering attempts.
   • BImplement multi-factor authentication (MFA) for customer account access.
   • CLog all customer service interactions for later review.
   • DIncrease the number of security questions asked during verification.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   At which stages of an operational process lifecycle should security requirements be integrated?

   • AOnly during the planning stage, before the process is implemented
   • BOnly during the review stage, to identify security failures after the fact
   • CThroughout all stages, from planning through execution and review
   • DOnly during the execution stage, when the process is actively running
   Reveal Solution Discussion Select an answer first
5. 19expert · hard · select all that apply

   A multinational corporation is developing a new employee offboarding process. The process must comply with data protection regulations, including the right to be forgotten for customers. The security team is eliciting requirements from various stakeholders. Select all the sources that should be consulted to gather comprehensive security requirements.

   • AMarketing department for brand messaging
   • BIT department for technical access control requirements
   • CExternal auditors for industry best practices
   • DLegal department for regulatory compliance requirements
   • EHuman resources for employee lifecycle policies
   Check answers Discussion Select an answer first
6. 20foundation · easy

   Which step is a key component of change management for security integration?

   • AAssessing the security impact of the proposed change
   • BRejecting all changes that involve any modification to security controls
   • CIgnoring the change if it is requested by a senior manager
   • DImplementing the change immediately and informing security later
   Reveal Solution Discussion Select an answer first