Integrating Security Requirements into Operational Processes CCISO Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A hospital is integrating a security requirement that all access to the medication dispensing system must be authenticated with a smart card. The current process uses a shared username and password for all nurses on a shift. The nursing staff is concerned that smart cards will be forgotten or lost, causing delays in patient care. What is the best control to implement?

   • ADelay the implementation until a perfect solution is found that eliminates all risk of forgotten cards.
   • BRequire nurses to use their personal smartphones as the smart card, but do not provide a fallback if the phone is lost.
   • CIssue individual smart cards to each nurse and implement a quick lockout/replacement procedure, with a temporary PIN-based fallback for emergencies.
   • DKeep the shared password but add a biometric fingerprint scanner to the dispensing system.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A software development company is integrating a security requirement that all code must be scanned for vulnerabilities before deployment. The developers are used to deploying code immediately after writing it. The CISO must implement this change with minimal resistance. Which change management tactic is most effective?

   • AMandate that all code must be scanned manually by a security team before deployment.
   • BDelay the requirement until the next major release cycle to avoid disrupting current work.
   • CInvolve developers in selecting the scanning tool and integrate the scan into the existing CI/CD pipeline so it is automated and fast.
   • DRequire developers to attend a security training session before they can deploy any code.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A bank is integrating a new regulatory requirement that all customer data must be encrypted in transit. The network team says that encrypting all internal traffic will degrade performance. The CISO must elicit the requirement into an operational specification. What is the most appropriate action?

   • AUpgrade all network hardware to the fastest available to compensate for encryption overhead.
   • BIdentify which data flows carry customer data and apply encryption only to those flows, using performance-appropriate protocols.
   • CAsk the regulator for an exemption from the encryption requirement due to performance concerns.
   • DEncrypt all network traffic regardless of performance impact to ensure full compliance.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which activity is an example of compliance verification for integrated security requirements?

   • AReviewing audit logs to ensure that access controls are being enforced
   • BDesigning a new security control for a future process
   • CSelecting a new security vendor
   • DTraining employees on new security policies
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which activity is a key part of operational process mapping for security integration?

   • ASelecting security software vendors before understanding the process
   • BConducting a penetration test on the operational network
   • CInterviewing process owners to understand the current workflow steps and dependencies
   • DWriting security policies for each department
   Reveal Solution Discussion Select an answer first