Integrating Security Requirements into Operational Processes CCISO Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A logistics company has integrated a security checkpoint into its package sorting process. The checkpoint requires that all packages with a value over $500 be scanned for prohibited items. The operations team reports that the checkpoint is causing bottlenecks during peak hours. The CISO must adjust the control without compromising the security requirement. What is the best action?

   • ARemove the checkpoint during peak hours and resume it later
   • BImplement a two-tier screening approach: an automated risk score for all packages and manual scanning only for high-risk packages
   • CAdd more staff to manually scan every package over $500
   • DRaise the value threshold to $1,000 to reduce the number of packages scanned
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A multinational bank is integrating security requirements into its cross-border wire transfer process. The process involves multiple handoffs between front-office, compliance, and back-office teams. The CISO must ensure that customer data is protected at each handoff without slowing down the transfer. What is the most effective approach?

   • AApply a blanket encryption policy to all data in the system
   • BRequire manual approval for every transfer to ensure security
   • COutsource the transfer process to a third-party provider
   • DMap the entire workflow, identify data touchpoints at each handoff, and apply encryption and access controls at those points
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of continuous improvement in the context of integrated security?

   • ATo increase the number of security controls regardless of need
   • BTo maintain the status quo and avoid changes to operational processes
   • CTo reduce the frequency of security audits
   • DTo refine and enhance security integration based on feedback and audit results
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A telecom company has integrated security controls into its network change approval process. The CISO wants to verify that the controls are consistently applied across all change requests. Which monitoring mechanism is most appropriate?

   • AA survey of change managers about their compliance
   • BA manual audit performed once a year
   • CA random sample of change tickets reviewed quarterly
   • DAutomated review of change tickets against security checklists
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A government agency is integrating a new requirement that all outgoing emails containing classified information must be automatically blocked. The current email process is decentralized, with each department using different email clients. The CISO must implement this control with minimal disruption. What is the best first step?

   • AImmediately deploy a data-loss-prevention (DLP) tool that blocks all outbound emails containing any sensitive keyword.
   • BRequire all departments to switch to a single email client that supports the blocking feature.
   • CTrain all employees on the new email policy and ask them to self-check before sending.
   • DMap the current email workflows for each department to understand how emails are sent and where a control could be inserted.
   Reveal Solution Discussion Select an answer first