Which of the following is a common source of security requirements during the elicitation process?

Industry standards such as ISO/IEC 27001

The number of employees in the organization

The organization's marketing strategy

The personal preferences of the CEO

A utility company is integrating a new security requirement that all remote access to the control system network must use multi-factor authentication (MFA). The current process uses a simple VPN with username and password. The CISO wants to embed this requirement without interrupting ongoing operations. Which approach best fits a structured integration framework?

Ask the IT team to configure MFA on the VPN but do not inform users until it is active.

Immediately disable the current VPN and require all users to use a new MFA-enabled VPN.

Define the MFA requirement as a policy, map the current remote access workflow, and implement MFA in a phased rollout with a fallback plan.

Purchase a new MFA solution and require all users to enroll within one week.

A healthcare provider has integrated a security requirement that all access to electronic health records (EHR) must be logged and reviewed monthly. The current logging system captures all access but produces massive volumes of data, making manual review impractical. The CISO needs to ensure the requirement is met without overwhelming the security team. Which approach is most effective?

Change the requirement to review logs quarterly instead of monthly.

Reduce the logging to only failed access attempts to decrease the volume.

Hire additional staff to manually review all logs each month.

Implement an automated log analysis tool that flags anomalous access patterns and generates a summary report for monthly review.

In the context of integrating security controls into operational processes, what is the role of a detective control?

To provide an alternative control when the primary control is not feasible

To identify and report security incidents or policy violations as they occur

To restore systems to a known good state after an incident

To prevent unauthorized access by enforcing authentication

A hospital is integrating a new patient data access logging requirement into its electronic health record (EHR) workflow. The clinical staff are concerned that logging will add extra steps. What change management tactic would best address staff concerns while ensuring the requirement is integrated?

Postpone the logging requirement until staff retire

Involve clinical staff in designing the logging steps and provide training before rollout

Threaten disciplinary action for non-compliance

Implement the logging silently in the background without staff involvement

EC-CouncilCertified Chief Information Security Officer

Domain 3Objective 3

Integrating Security Requirements into Operational Processes CCISO Practice Questions (Page 4)

Part of the Security Program Management and Operations domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

7concepts

Questions 16–20

16foundation · easy
Which of the following is a common source of security requirements during the elicitation process?
Select an answer first
17application · medium
A utility company is integrating a new security requirement that all remote access to the control system network must use multi-factor authentication (MFA). The current process uses a simple VPN with username and password. The CISO wants to embed this requirement without interrupting ongoing operations. Which approach best fits a structured integration framework?
Select an answer first
18expert · hard
A healthcare provider has integrated a security requirement that all access to electronic health records (EHR) must be logged and reviewed monthly. The current logging system captures all access but produces massive volumes of data, making manual review impractical. The CISO needs to ensure the requirement is met without overwhelming the security team. Which approach is most effective?
Select an answer first
19foundation · easy
In the context of integrating security controls into operational processes, what is the role of a detective control?
Select an answer first
20application · medium
A hospital is integrating a new patient data access logging requirement into its electronic health record (EHR) workflow. The clinical staff are concerned that logging will add extra steps. What change management tactic would best address staff concerns while ensuring the requirement is integrated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Integrating Security Requirements into Operational Processes CCISO Practice Questions (Page 4)

Questions 16–20

Which of the following is a common source of security requirements during the elicitation process?

In the context of integrating security controls into operational processes, what is the role of a detective control?

A hospital is integrating a new patient data access logging requirement into its electronic health record (EHR) workflow. The clinical staff are concerned that logging will add extra steps. What change management tactic would best address staff concerns while ensuring the requirement is integrated?

Keep studying — Security Program Management and Operations