Integrating Security Requirements into Operational Processes CCISO Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary goal of change management when integrating security requirements into operational processes?

   • ATo eliminate the need for user training
   • BTo replace all existing operational processes with new ones
   • CTo document all security incidents for regulatory compliance
   • DTo implement security changes with minimal disruption and resistance
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A retail company has integrated a security requirement that all point-of-sale (POS) terminals must have antivirus updates applied within 48 hours of release. The CISO needs to verify that this requirement is being met across all stores. Which mechanism is most appropriate?

   • AConfigure the antivirus management console to generate a weekly compliance report showing the last update time for every POS terminal.
   • BConduct an annual audit of a sample of POS terminals in the head office only.
   • CRely on the antivirus vendor's general threat report to infer that all terminals are protected.
   • DAsk store managers to self-certify each month that updates are applied.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A logistics company integrated a security control that requires all GPS tracking devices on delivery vehicles to be patched within 7 days. After six months, the CISO notices that the patch compliance rate is only 60%. The operations team says the 7-day window is too short because vehicles are often on the road. What should the CISO do first?

   • ADisable the monitoring report because it is causing conflict with the operations team.
   • BImmediately extend the patch window to 14 days to accommodate the operations team's concern.
   • CMandate that all vehicles be taken out of service for patching on a fixed day each month.
   • DAnalyze the patch compliance data to identify patterns, such as which vehicles miss the window and why, then adjust the process or window based on evidence.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A regional hospital is integrating a new patient-data privacy regulation into its admission and discharge workflows. The CISO wants to ensure that every step where protected health information is accessed or transmitted is identified before any control is applied. Which approach best achieves this?

   • AUpdate the security policy to state that all patient data must be encrypted and require staff to acknowledge the policy annually.
   • BConduct a detailed walkthrough of the admission and discharge processes, documenting each step, data touchpoint, and handoff, then map applicable privacy requirements to those steps.
   • CAsk the IT help desk to log any complaints about data access issues and use those logs to infer where privacy controls are needed.
   • DDeploy a data-loss-prevention agent on all hospital workstations and rely on its alerts to reveal where patient data is being used.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A hospital has integrated a requirement that all access to patient records be logged and reviewed. The IT team has implemented automated logging, but the compliance officer wants to ensure that the logs are actually being reviewed and that anomalies are acted upon. The CISO must design a monitoring mechanism that balances thoroughness with limited staff resources. What is the most effective approach?

   • AAutomate the review entirely with no human oversight
   • BRequire manual review of every single access log entry
   • CImplement a risk-based alerting system that flags high-risk access events and requires timely review, while lower-risk events are reviewed in periodic samples
   • DStore logs but only review them if a complaint is filed
   Reveal Solution Discussion Select an answer first