Integrating Security Requirements into Operational Processes ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A government agency is redesigning its citizen services portal. The security team must gather security requirements from multiple stakeholders, including the privacy office, the IT department, and external auditors. The stakeholders have conflicting priorities: the privacy office wants strict data minimization, while the IT department wants to enable data sharing for analytics. As the security manager, how should you reconcile these requirements?

   • AFacilitate a workshop to align stakeholders on risk tolerance and document a balanced set of requirements.
   • BEscalate the conflict to senior management without further analysis.
   • CPrioritize the privacy office's requirements because they are regulatory.
   • DPrioritize the IT department's requirements to enable analytics.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is it essential for an organization to integrate security requirements into its operational processes?

   • ATo satisfy external auditors without changing how work is performed
   • BTo shift all security responsibility from IT to business unit managers
   • CTo ensure that security controls are consistently applied as part of routine business activities
   • DTo eliminate the need for dedicated security staff and reduce the security budget
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A bank is mapping its online banking process, which includes user login, account viewing, fund transfer, and transaction confirmation. The security team has identified that the fund transfer step is vulnerable to session hijacking. The bank also wants to minimize user friction. What control should be implemented at that step?

   • ADisable the fund transfer feature for all users.
   • BUse a longer session timeout to reduce user frustration.
   • CRequire multi-factor authentication for every login.
   • DImplement step-up authentication for fund transfers above a certain amount.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of establishing monitoring mechanisms for integrated security requirements?

   • ATo verify that security requirements are being met in practice
   • BTo generate reports only for regulatory compliance
   • CTo replace the need for periodic security audits
   • DTo eliminate the need for security training
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A retail company is updating its point-of-sale (POS) system to accept contactless payments. The security team has mandated that the new system encrypt all payment data. The operations team is concerned about the impact on transaction speed. What is the best approach to manage this change while maintaining security?

   • AImplement the new system without encryption and add it later if needed
   • BImplement the encryption requirement and test the transaction speed during a pilot phase
   • CRemove the encryption requirement to ensure fast transactions
   • DLet the operations team decide whether to implement encryption
   Reveal Solution Discussion Select an answer first