Integrating Security Requirements into Operational Processes ACCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A logistics company is mapping its package delivery process. The process includes receiving packages, sorting them, loading trucks, and delivering to customers. The company has identified a risk of packages being stolen during the loading step. Which security control would be most appropriate to mitigate this specific risk?

   • AConducting background checks on all new employees
   • BRequiring two employees to be present during the loading of trucks
   • CInstalling GPS trackers on delivery trucks
   • DImplementing a customer signature requirement upon delivery
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A healthcare organization is updating its patient record retrieval process to improve efficiency. The new process will allow support staff to access records via a new portal. The security team has mandated that all access be logged and reviewed. However, the operations team wants to minimize delays in patient care. What is the best approach to integrate security without disrupting operations?

   • AImplement the new portal with automated logging and periodic access reviews, and train staff on the new process
   • BDefer the security requirements until after the new process is fully operational
   • CRequire manual approval from a supervisor for every record access
   • DAllow access without logging to avoid any impact on performance
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A hospital is mapping its patient record access process. The process involves registration, nurse triage, physician consultation, and billing. The security team must ensure that only authorized personnel access patient records. What is the most effective way to integrate security controls into this process?

   • AConduct regular security awareness training for all hospital staff.
   • BEncrypt all patient records and store them in a secure data center.
   • CRequire all staff to sign a confidentiality agreement annually.
   • DImplement role-based access control (RBAC) at each step, ensuring each role only sees data necessary for their function.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A financial services firm is changing its customer verification process to use a new biometric system. The security team has approved the change, but the operations team is concerned about the impact on customer wait times. The change management process requires a risk assessment before implementation. What is the most important factor to consider in the risk assessment?

   • AThe training time required for staff to use the new system
   • BThe cost of the new biometric system compared to the old verification method
   • CThe potential for the new system to introduce new security vulnerabilities or fail to meet existing security requirements
   • DThe customer wait time during the transition period
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A utility company is updating its remote monitoring process for critical infrastructure. The security team needs to gather security requirements from various sources. Which source is most likely to provide specific technical security requirements?

   • AMarketing materials from technology vendors.
   • BThe company's annual report to shareholders.
   • CIndustry standards such as NIST or ISO 27001.
   • DGeneral employee feedback about the current process.
   Reveal Solution Discussion Select an answer first