Designing, Deploying, and Managing Security Controls CCISO Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A large enterprise is deploying a new identity and access management (IAM) system. The deployment must integrate with existing Active Directory and multiple SaaS applications. The CISO is concerned about user productivity and wants to minimize downtime. Which deployment approach best balances risk and user impact?

   • APhased deployment starting with a pilot group, then rolling out by department, with rollback procedures.
   • BBig-bang deployment over a weekend to all users and applications.
   • CDeploy the new IAM only to new employees and gradually migrate existing users over a year.
   • DParallel run of the new IAM alongside the old system for all users for one month.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A global organization is deploying a new security information and event management (SIEM) system. The deployment must comply with local data residency laws in multiple countries, and the CISO must ensure that the SIEM can collect logs from all regions without violating these laws. What is the most important design consideration?

   • AUsing a cloud-based SIEM with encryption to protect logs in transit and at rest.
   • BDeploying regional SIEM instances that process and store logs locally, with only metadata shared globally.
   • CDeploying a single centralized SIEM in one region to simplify management.
   • DCollecting logs only from regions that do not have data residency laws.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A regional bank is deploying a new internet-facing customer portal. The security team has decided to place a web application firewall (WAF) in front of the application, enforce multi-factor authentication for all administrative access, and implement a database activity monitoring solution. Which combination of control categories and types does this represent?

   • ADetective technical controls (WAF and MFA) with a preventive administrative control (database activity monitoring)
   • BPreventive administrative controls (WAF and MFA) with a corrective technical control (database activity monitoring)
   • CCorrective technical controls (WAF and MFA) with a preventive physical control (database activity monitoring)
   • DPreventive technical controls (WAF and MFA) with a detective technical control (database activity monitoring)
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is subject to both GDPR and PCI DSS. The CISO is designing a control framework to satisfy both regulations. Some GDPR requirements conflict with PCI DSS logging requirements (e.g., data minimization vs. retention of logs). What is the best approach to resolve this conflict?

   • AFollow GDPR and delete logs as soon as possible to comply with data minimization.
   • BUse a compensating control to avoid logging altogether.
   • CFollow PCI DSS and retain all logs for the required period, ignoring GDPR.
   • DConduct a legal and risk assessment to find a balance, such as minimizing log content while retaining necessary data for the required period.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of change management in the deployment of security controls?

   • ATo ensure changes are reviewed, approved, and implemented in a controlled manner
   • BTo eliminate the need for testing
   • CTo speed up the deployment process by bypassing approvals
   • DTo document the cost of the control
   Reveal Solution Discussion Select an answer first