Designing, Deploying, and Managing Security Controls CCISO Practice Questions (Page 9)

Questions 41–45

1. 41application · easy

   A company is implementing a new policy that requires all employees to use a VPN when working remotely. The VPN is considered a security control. Which category and type does this control belong to?

   • ATechnical preventive control
   • BPhysical corrective control
   • CTechnical compensating control
   • DAdministrative detective control
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An organization is deploying a new endpoint detection and response (EDR) solution across 5,000 endpoints. The CISO wants to minimize disruption to business operations while ensuring the solution is effective. Which deployment strategy should be used?

   • APilot on a small group of IT users, then gradually roll out to the rest of the organization in phases.
   • BDeploy to all endpoints simultaneously during a maintenance window to ensure consistent coverage.
   • CUse a third-party managed service to deploy the solution without any internal testing.
   • DDeploy only to high-risk departments first, then to the remaining departments after a month.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A government contractor must comply with NIST SP 800-171 for controlled unclassified information (CUI). The security team is designing a control set to meet the requirements. Which approach best ensures alignment with the framework?

   • AOnly implement controls that are easy to deploy, regardless of whether they meet the requirements
   • BWait for a formal audit before implementing any controls
   • CImplement a set of controls based on industry best practices without mapping to NIST SP 800-171
   • DMap each NIST SP 800-171 requirement to a specific control and document the implementation evidence
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security team has been managing a legacy intrusion prevention system (IPS) for years. The IPS is still supported, but it generates a high volume of false positives, causing alert fatigue. The CISO is considering replacing it with a newer system. What should the CISO do first?

   • ATune the existing IPS to reduce false positives before considering replacement.
   • BIncrease the number of security analysts to handle the alert volume.
   • CReplace the IPS immediately to reduce alert fatigue.
   • DDecommission the IPS because it is causing too many alerts.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A startup is designing security controls for its cloud infrastructure. The CISO wants to implement the principle of least privilege for all user and service accounts. Which action best exemplifies least privilege?

   • AGranting all users administrative access to simplify management
   • BGranting permissions based on the user's seniority rather than job function
   • CUsing a single shared account for all administrators
   • DGranting each user only the permissions required to perform their job function
   Reveal Solution Discussion Select an answer first