An organization's security policy requires that all employees complete security awareness training annually. The training department wants to know the specific steps to enroll employees and track completion. What should be referenced?

The security guideline for training best practices

The security standard for training content

The security procedure for training administration

A security analyst is responding to a malware incident. The incident response policy requires that the analyst 'contain and eradicate the threat.' The analyst needs to know the exact order of steps to isolate affected systems. What should the analyst consult?

The incident response guideline

The incident response procedure

Which statement best describes the primary purpose of a security policy in an organization?

To establish management's intent and high-level rules for protecting information assets

To list specific software versions that must be used across the organization

To provide step-by-step instructions for configuring firewalls

To recommend best practices that are optional to follow

A large enterprise has a security policy that mandates 'all remote access must be secured.' The network team is evaluating whether to use IPsec VPN or SSL VPN. The policy does not specify which technology. The security team wants to ensure that the chosen technology is consistently implemented across all remote users. What should they do?

Create a security guideline recommending either VPN technology

Create a security standard that mandates the use of IPsec VPN for all remote access

Update the security policy to specify the exact VPN technology

Create a security procedure for configuring both VPN types

CompTIASecurityX (CASP+)

Domain 1Objective 1

Security Program Documentation CAS-005 Practice Questions (Page 3)

Part of the Governance, risk, and compliance domain, which accounts for 20% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 1–2 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

4concepts

20%of the exam

Questions 11–15

11application · medium
An organization's security policy requires that all employees complete security awareness training annually. The training department wants to know the specific steps to enroll employees and track completion. What should be referenced?
Select an answer first
12application · medium
A security analyst is responding to a malware incident. The incident response policy requires that the analyst 'contain and eradicate the threat.' The analyst needs to know the exact order of steps to isolate affected systems. What should the analyst consult?
Select an answer first
13application · medium
A multinational company must ensure that all regional offices configure their firewalls consistently to meet the corporate security policy. Which document type should be mandated to achieve this consistency?
Select an answer first
14foundation · easy
Which statement best describes the primary purpose of a security policy in an organization?
Select an answer first
15expert · hard
A large enterprise has a security policy that mandates 'all remote access must be secured.' The network team is evaluating whether to use IPsec VPN or SSL VPN. The policy does not specify which technology. The security team wants to ensure that the chosen technology is consistently implemented across all remote users. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Security Program Documentation CAS-005 Practice Questions (Page 3)

Questions 11–15

An organization's security policy requires that all employees complete security awareness training annually. The training department wants to know the specific steps to enroll employees and track completion. What should be referenced?

A security analyst is responding to a malware incident. The incident response policy requires that the analyst 'contain and eradicate the threat.' The analyst needs to know the exact order of steps to isolate affected systems. What should the analyst consult?

A multinational company must ensure that all regional offices configure their firewalls consistently to meet the corporate security policy. Which document type should be mandated to achieve this consistency?

Which statement best describes the primary purpose of a security policy in an organization?

Keep studying — Governance, risk, and compliance