Integrating Security Requirements into Operational Processes CCISO Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A city government integrated a security requirement that all public-facing web forms must include a CAPTCHA to prevent automated abuse. After implementation, the IT team reports a significant increase in help desk calls from citizens who cannot complete the forms. The CISO must refine the integration to reduce friction while maintaining the security control. What is the best action?

   • AKeep the current CAPTCHA and tell citizens they must use it despite the difficulty.
   • BRemove the CAPTCHA entirely to eliminate the help desk burden.
   • CAnalyze the help desk data to identify the specific CAPTCHA issues and test alternative CAPTCHA types (e.g., image-based, checkbox) with a sample of users.
   • DReplace the CAPTCHA with a simple math question that is easier for users.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A healthcare provider has integrated a security requirement that all access to patient records be logged and that any access outside of normal working hours be flagged for review. The IT team has implemented the logging, but the compliance officer is concerned that the flagging is generating too many false positives, overwhelming the review team. The CISO must adjust the monitoring mechanism. What is the best action?

   • ADisable the flagging for night shifts because they are legitimate
   • BIncrease the number of review staff to handle all flagged events
   • CRefine the flagging criteria to include contextual factors such as job role and patient relationship, and escalate only high-risk anomalies
   • DRequire all flagged events to be reviewed within 24 hours regardless of risk
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A financial firm has integrated a security requirement that all employee access to customer financial data must be reviewed quarterly. The current access review process is manual and often misses inactive accounts. The CISO wants to improve compliance verification. Which mechanism is most effective?

   • ARely on the HR system to automatically revoke access when an employee leaves, without further review.
   • BConduct the access review only when a security incident occurs.
   • CAutomate the access review by generating a report of all users with access to customer data and comparing it against the current employee list, flagging discrepancies.
   • DAsk each manager to manually review their team's access and sign a form confirming it is correct.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which approach best describes a structured framework for embedding security requirements into existing operational processes while maintaining business continuity?

   • AReplacing all existing operational processes with new security-focused processes to ensure full compliance
   • BApplying security requirements only during scheduled maintenance windows to minimize operational disruption
   • CIncorporating security requirements into the design and execution of existing operational workflows with minimal disruption
   • DIntegrating security requirements as a separate, parallel process that runs independently of daily operations
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A telecom company integrated a security control that requires all network device configurations to be backed up weekly. After a major outage, it was discovered that the backup process had been failing silently for months. The CISO must improve the process to prevent this from recurring. What is the most effective improvement?

   • ARequire the network team to manually verify backups by logging into each device weekly.
   • BAdd automated alerts that notify the network team when a backup fails, and include backup success in the monthly security review metrics.
   • CDisable the backup process until a new backup solution is purchased.
   • DIncrease the backup frequency to daily to reduce the risk of data loss.
   Reveal Solution Discussion Select an answer first