Integrating Security Requirements into Operational Processes CCISO Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A retail chain is integrating a security requirement that all customer loyalty account changes must be logged and monitored for fraud. The current process allows customer service representatives to update accounts directly. The CISO must identify where to place the logging control. What is the best approach?

   • AAsk the customer service team to manually note any changes they make in a shared spreadsheet.
   • BMap the account update workflow, including all systems and interfaces, and identify the exact point where a change is committed to the database.
   • CEnable logging on all database transactions regardless of the source.
   • DInstall a screen-recording tool on all customer service workstations.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A hospital has integrated a security requirement that all portable media (USB drives) must be encrypted before use. The CISO needs to verify that this requirement is being followed. Which monitoring mechanism is most appropriate?

   • ARely on staff to self-report if they use an unencrypted USB drive.
   • BConduct a monthly physical inspection of all USB drives in use.
   • CCheck the encryption status only when a security incident occurs.
   • DDeploy endpoint management software that enforces encryption on all USB drives and reports any device that is not encrypted.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of security requirements elicitation?

   • ATo assign security roles and responsibilities to operational staff
   • BTo gather and translate business, regulatory, and technical needs into actionable security specifications
   • CTo purchase security tools and software for the organization
   • DTo test security controls after they have been implemented
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A manufacturing company has a production line that relies on a legacy SCADA system. The CISO must integrate a new requirement that all remote vendor access be logged and reviewed. The operational process currently allows vendors to connect via a shared VPN account. What is the most effective control to implement?

   • ADisable remote access entirely and require vendors to be physically present for all maintenance.
   • BReplace the shared VPN account with individual vendor accounts and configure logging of each session, then schedule weekly review of the logs.
   • CAdd a firewall rule that blocks all vendor VPN traffic after business hours.
   • DRequire vendors to sign a non-disclosure agreement before each remote session.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A retail company is integrating mandatory security checkpoints into its order fulfillment process. The operations manager worries that the new steps will slow down workers and cause resistance. What change management approach best minimizes disruption while ensuring the security requirements are adopted?

   • APilot the checkpoints with one team, gather feedback, then refine and roll out gradually
   • BDelay all changes until the next annual audit
   • CAutomate the checkpoints without informing staff
   • DImplement the checkpoints immediately and enforce compliance through disciplinary action
   Reveal Solution Discussion Select an answer first