Security Program Documentation CAS-005 Practice Questions (Page 4)

Questions 16–17

1. 16expert · hard

   A security policy requires that 'all security incidents be reported within one hour.' The incident response team is developing a procedure to meet this requirement. However, the team is concerned that the procedure is too rigid and does not account for different types of incidents. What is the best approach?

   • AUpdate the policy to allow different reporting times for different incident types
   • BCreate a guideline that recommends reporting times for different incident types
   • CCreate separate procedures for different incident types, all aligned with the policy
   • DCreate a single procedure that covers all incident types with the same steps
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the main purpose of a security standard?

   • ATo provide optional recommendations for enhancing security
   • BTo list the steps for performing a security audit
   • CTo define mandatory technical requirements that support the security policy
   • DTo outline the organization's security vision and goals
   Reveal Solution Discussion Select an answer first