A multinational corporation is deploying a new identity and access management (IAM) system. The deployment must comply with data residency requirements in the EU and Asia, and the system must integrate with existing on-premises HR systems. The project has a tight deadline. Which deployment approach best balances compliance, integration, and timeline?

Deploy a cloud-based IAM solution with regional data residency options and use a phased rollout to integrate with HR systems

Deploy the IAM system in a single region and delay integration with HR systems until after the deadline

Deploy a cloud IAM solution without considering data residency, relying on encryption to satisfy compliance

Deploy a single on-premises IAM instance in the EU and have all regions access it remotely

A security architect is designing access controls for a new financial application. The principle of least privilege requires that users be granted:

The minimum level of access necessary to perform their job functions

Access based on their seniority in the organization

Temporary administrative rights that expire after 24 hours

Access to all resources to ensure operational efficiency

When should a security control be decommissioned?

When it is no longer effective or relevant to the current risk landscape

When the control is working perfectly and has no issues

Immediately after its initial deployment to avoid maintenance costs

Only when a regulatory body mandates it

A security operations team is reviewing the lifecycle of a firewall rule set. They notice that many rules have not been reviewed in over a year, and some rules are no longer needed. What is the best practice for managing these firewall rules?

Conduct a periodic rule review and remove or update rules that are no longer required

Replace the firewall with a new one to avoid the review process

Leave the rules in place to avoid breaking any unknown dependencies

Only add new rules when needed, but never remove old ones

EC-CouncilCertified Chief Information Security Officer

Domain 2Objective 1

Designing, Deploying, and Managing Security Controls CCISO Practice Questions (Page 3)

Part of the Information Security Controls and Audit Management domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 11–15

11expert · hard
A multinational corporation is deploying a new identity and access management (IAM) system. The deployment must comply with data residency requirements in the EU and Asia, and the system must integrate with existing on-premises HR systems. The project has a tight deadline. Which deployment approach best balances compliance, integration, and timeline?
Select an answer first
12foundation · easy
A security architect is designing access controls for a new financial application. The principle of least privilege requires that users be granted:
Select an answer first
13foundation · easy
When should a security control be decommissioned?
Select an answer first
14application · medium
A security operations team is reviewing the lifecycle of a firewall rule set. They notice that many rules have not been reviewed in over a year, and some rules are no longer needed. What is the best practice for managing these firewall rules?
Select an answer first
15foundation · easy
A U.S. federal agency must select security controls for its information systems. Which framework is most directly applicable to federal agencies and provides a comprehensive catalog of controls?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Designing, Deploying, and Managing Security Controls CCISO Practice Questions (Page 3)

Questions 11–15

A security architect is designing access controls for a new financial application. The principle of least privilege requires that users be granted:

When should a security control be decommissioned?

A security operations team is reviewing the lifecycle of a firewall rule set. They notice that many rules have not been reviewed in over a year, and some rules are no longer needed. What is the best practice for managing these firewall rules?

A U.S. federal agency must select security controls for its information systems. Which framework is most directly applicable to federal agencies and provides a comprehensive catalog of controls?

Keep studying — Information Security Controls and Audit Management