Implementing Control Assurance Frameworks CCISO Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A financial services firm has implemented a control assurance framework and wants to ensure that controls remain effective over time. The CISO needs to establish a process for ongoing monitoring and improvement. Which action is most aligned with continuous monitoring?

   • ADisable monitoring alerts to reduce noise and focus only on annual reviews.
   • BSchedule periodic control testing and review key risk indicators (KRIs) on a regular basis.
   • CPerform a one-time comprehensive audit and then stop monitoring until the next certification cycle.
   • DRely exclusively on external auditors to identify all control deficiencies.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An organization has implemented ISO/IEC 27001 controls and needs to assess their effectiveness. The CISO wants to ensure that the assessment provides reliable evidence for the management review. Which approach should the CISO choose?

   • APerform a single annual review of all controls without sampling or testing.
   • BRely solely on self-assessment checklists completed by control owners.
   • CUse only automated monitoring tools and ignore manual controls.
   • DConduct internal audits using trained auditors and review evidence of control operation.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company's control assurance program is mature, but the CISO is concerned that the program is not agile enough to respond to rapid changes in the threat landscape. The CISO wants to make the program more adaptive. Which change would be most effective?

   • ACentralize all decision-making with the CISO to speed up changes.
   • BImplement a continuous risk assessment process that feeds directly into control adjustments.
   • CLimit the number of controls to reduce complexity and speed up changes.
   • DReduce the frequency of control testing to allow more time for analysis.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A healthcare organization has implemented controls aligned with the HITRUST Common Security Framework (CSF). The CISO wants to assess whether the implemented controls are effective in protecting patient data. Which assessment approach provides the most reliable evidence of control effectiveness?

   • AAnalyze security incident reports from the past year to identify any breaches that occurred.
   • BInterview the IT staff to confirm that they believe the controls are working as intended.
   • CReview configuration settings of key systems against the HITRUST CSF requirements.
   • DVerify that all employees have completed annual security awareness training.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A large enterprise is implementing the NIST SP 800-53 control framework. The CISO has limited budget and must prioritize the implementation of controls. The organization has identified that its most critical assets are customer data and intellectual property. Which control implementation strategy best balances risk reduction and resource constraints?

   • AImplement only the controls that are easiest to deploy to show quick progress.
   • BImplement all high-impact controls across the entire enterprise simultaneously.
   • CDefer all control implementation until the next fiscal year when more budget is available.
   • DPrioritize controls that protect the critical assets and implement them in phases based on risk.
   Reveal Solution Discussion Select an answer first