Integrating Security Requirements into Operational Processes CCISO Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a key component of an effective change management process for security integration?

   • AStakeholder communication and training
   • BFocusing only on technical aspects and ignoring human factors
   • CExcluding end users from the change process to avoid confusion
   • DImmediate implementation without prior planning
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A manufacturing firm has a production scheduling process that is critical to operations. The CISO must integrate a security control that requires all changes to the scheduling system to be approved by a manager. The current process allows any production supervisor to make changes directly. The operations manager is concerned that adding an approval step will delay urgent schedule changes. What is the best control to implement?

   • ADisable the ability to make any changes to the scheduling system until a formal approval process is fully automated.
   • BImplement a role-based access control (RBAC) system where only designated managers can approve changes, but allow supervisors to submit change requests that can be approved quickly via a mobile app.
   • CRequire all changes to be approved by the IT department, which is available only during business hours.
   • DKeep the current process but add a weekly log review to catch unauthorized changes after the fact.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the purpose of continuous monitoring in the context of integrated security requirements?

   • ATo replace the need for periodic security audits
   • BTo ensure that security controls remain effective and compliant over time
   • CTo eliminate all security incidents
   • DTo automate all security controls
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An e-commerce company has integrated a security checkpoint into its order approval workflow. The checkpoint flags orders that exceed a certain value for manual review. The company now wants to detect if any flagged orders are being approved without review. Which control should be added?

   • AA corrective control that reverses the approval
   • BA deterrent control that reminds approvers of policy
   • CA detective control that logs and alerts when a flagged order is approved without review
   • DA preventive control that blocks all high-value orders
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A manufacturing company is integrating security into its supplier onboarding process. The team has mapped the workflow and identified that supplier documentation is uploaded to a shared drive. Which control type should be added at the upload step to prevent unauthorized access to sensitive supplier contracts?

   • ACorrective control—restore files after a breach
   • BDeterrent control—display a warning banner on the drive
   • CDetective control—review access logs weekly
   • DPreventive control—enforce access permissions and encryption on the shared drive
   Reveal Solution Discussion Select an answer first