Integrating Security Requirements into Operational Processes CCISO Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A financial services firm has integrated encryption and access review controls into its customer data handling processes. The CISO now wants to ensure these controls remain effective over time. Which mechanism should be established to continuously verify that the integrated controls are operating as intended?

   • AAnnual employee security awareness training
   • BA risk assessment performed every three years
   • CA one-time penetration test after implementation
   • DAutomated logging and periodic compliance audits
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   After a quarterly audit of its procurement process, a logistics company finds that several security checkpoints are being bypassed because they conflict with the purchasing timeline. The CISO wants to improve the integration. What is the most appropriate action based on the audit findings?

   • ARemove the checkpoints to avoid delays
   • BIncrease penalties for employees who bypass the checkpoints
   • CRevise the procurement workflow to embed the checkpoints in a way that aligns with the timeline
   • DIgnore the findings because the audit was only quarterly
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A government agency is integrating security requirements into its citizen service delivery process. The process involves multiple departments and legacy systems. The CISO must ensure that the integration does not disrupt service delivery while meeting strict compliance deadlines. What is the most effective framework?

   • AReplace all legacy systems with a new secure platform before integrating controls
   • BUse a phased integration framework that maps each department's workflow, identifies dependencies, and implements controls in stages with fallback plans
   • CImplement all controls simultaneously across all departments to meet the deadline
   • DFocus only on the department with the highest risk and ignore the others
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A software development firm has integrated security requirements into its code deployment pipeline. After six months, the security team notices that the integrated scanning step is frequently skipped during emergency fixes. What is the best continuous improvement action?

   • AIncrease the frequency of security audits
   • BRequire all emergency fixes to go through the full standard change process
   • CAnalyze the root cause of the skips and adjust the emergency fix process to include a streamlined security review
   • DDisable the scanning step for emergency fixes to speed up deployment
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A manufacturing firm is integrating a new security requirement into its just-in-time inventory system. The requirement mandates that all supplier invoices be digitally signed before payment. The operations team fears this will delay payments and strain supplier relationships. The CISO must balance security with business continuity. What is the best course of action?

   • APilot the digital signature requirement with a small group of suppliers, measure the impact on payment times, and then refine the process before full rollout
   • BAllow suppliers to submit unsigned invoices for one more year
   • CPay suppliers first and verify signatures later
   • DImmediately require digital signatures from all suppliers to meet the compliance deadline
   Reveal Solution Discussion Select an answer first