Designing, Deploying, and Managing Security Controls CCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security control has been in place for several years, but recent penetration tests have shown that it can be bypassed. The control is still required for compliance. The CISO must decide whether to remediate, replace, or decommission the control. What is the most appropriate decision-making approach?

   • AKeep the control in place and document the bypass as a known issue.
   • BImmediately decommission the control because it is ineffective.
   • CReplace the control with a new one that is not bypassable, regardless of cost.
   • DConduct a risk assessment to evaluate the impact of the bypass, then decide whether to remediate, replace, or accept the risk with compensating controls.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial services firm is designing a new customer-facing web application that will handle sensitive personal data. The security team has been asked to implement controls that prevent unauthorized access while also ensuring that if a breach occurs, the organization can detect it quickly and restore services. Which combination of control types best meets these requirements?

   • AUse a compensating control by outsourcing security monitoring to a managed security service provider (MSSP) and rely on the cloud provider's backup service.
   • BImplement a strong password policy and conduct quarterly security awareness training; maintain an incident response plan.
   • CEncrypt all data at rest and in transit; implement a SIEM system to collect and analyze logs.
   • DDeploy a web application firewall (WAF) and require multi-factor authentication for all users; implement intrusion detection and automated backup restoration.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A CISO is reviewing the results of a security control assessment. The assessment found that a critical control is not operating as intended, but the control is required for regulatory compliance. The CISO must decide how to address this finding. Which action is most appropriate?

   • AIgnore the finding because the control is required and cannot be changed
   • BWait for the next audit to see if the finding is repeated
   • CImplement a compensating control and document the deviation for the auditor
   • DRemove the control entirely to avoid the assessment finding
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A CISO wants to measure the effectiveness of the organization's security awareness training program. Which metric would provide the most meaningful insight into whether the training is changing employee behavior?

   • ANumber of training sessions offered per year
   • BPercentage of employees who complete the training module
   • CEmployee satisfaction survey scores for the training
   • DNumber of phishing simulation clicks before and after training
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An organization has implemented a security control that is technically effective but is causing significant user friction, leading to employees finding workarounds. The CISO wants to assess the overall effectiveness of the control. What should the CISO consider?

   • AOnly the technical effectiveness of the control, as user behavior is not a security control issue.
   • BThe compliance requirements only, since the control meets regulatory standards.
   • CThe cost of the control and whether it fits the budget.
   • DBoth the technical effectiveness and the usability of the control, as workarounds can undermine security.
   Reveal Solution Discussion Select an answer first