Integrating Security Requirements into Operational Processes ACCISO Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A regional bank is redesigning its customer onboarding process. The compliance team has identified that new accounts must be verified against a sanctions list before activation. The operations team is mapping the process flow and needs to ensure this requirement is enforced. Where should the security control be placed?

   • AOnly when the customer attempts their first transaction
   • BAt the end of the process, during the final audit review
   • CDuring the initial customer inquiry, before any documentation is collected
   • DAt the point in the process where the account is created, before any funds can be deposited
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A software company has integrated security requirements into its code deployment process, including code reviews and automated vulnerability scanning. The company wants to ensure that these requirements are consistently met. Which monitoring mechanism would be most effective?

   • ARelying on the development team to report any security issues they encounter
   • BAutomated tools that scan code for vulnerabilities and generate reports for each deployment
   • CA quarterly security audit of the deployment process
   • DManual code reviews conducted by a single developer
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A software development company is adopting a new agile methodology. The security team wants to ensure that security is considered in every sprint. Which practice best supports security-by-design in an agile environment?

   • AUse a separate security backlog that is addressed after the main development.
   • BConduct a security review at the end of the project.
   • CInclude security tasks in the definition of done for each sprint.
   • DAssign a security specialist to the team but only for critical features.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A manufacturing company is updating its supply chain management system to integrate with a new vendor portal. The change will affect how purchase orders are processed. The security team has identified that the new portal will transmit sensitive order data. What should the security manager do to ensure security requirements are maintained during this change?

   • ATrain employees on the new portal's features and security policies.
   • BPerform a security impact assessment of the change and update the process documentation with new security controls.
   • CRequire the vendor to sign a security agreement before the portal goes live.
   • DDisable the old system immediately after the new portal is launched.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A hospital is mapping its patient admission process. The process includes registration, triage, treatment, and discharge. The hospital has identified a risk of unauthorized access to patient records during registration. Which control would be most appropriate to mitigate this risk?

   • AEncrypting all patient records at rest
   • BImplementing role-based access controls so that only registration staff can view patient records during registration
   • CInstalling surveillance cameras in the registration area
   • DConducting regular security awareness training for all staff
   Reveal Solution Discussion Select an answer first