Designing, Deploying, and Managing Security Controls CCISO Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   When deploying a new security control, which of the following is a key consideration for integration with existing systems?

   • ADeploying the control without any testing
   • BIgnoring user training and awareness
   • CEnsuring the control does not disrupt business operations
   • DSelecting the most expensive control available
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A global organization must comply with both GDPR and the California Consumer Privacy Act (CCPA). The security team is designing a data access control system. Which design consideration is most critical to satisfy both regulations?

   • AUsing a single global privacy policy for all users
   • BImplementing granular access controls that can enforce data subject rights, such as access and deletion requests, across all data stores
   • CEnsuring that all data is encrypted at rest and in transit
   • DStoring all personal data in the EU to simplify compliance
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which security control design principle emphasizes implementing multiple layers of controls so that if one control fails, another is available to prevent or mitigate an attack?

   • ALeast privilege
   • BRisk-based selection
   • CDefense in depth
   • DSeparation of duties
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security control has been in production for three years. The vendor has announced end-of-life for the product, and the organization is planning to replace it. According to security control lifecycle management, what should the CISO do FIRST?

   • AExtend the vendor support contract indefinitely to keep the current control running.
   • BDevelop a transition plan that includes risk assessment, replacement deployment, and a decommissioning schedule.
   • CImmediately decommission the control to reduce risk from lack of vendor support.
   • DConduct a security audit to document the control's current effectiveness before making any decisions.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   How do security controls support the audit process?

   • ABy providing evidence that security requirements are being met
   • BBy increasing the scope of audits
   • CBy making audits unnecessary
   • DBy hiding security weaknesses from auditors
   Reveal Solution Discussion Select an answer first