Security Governance SY0-701 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Who is ultimately responsible for the overall success of an organization's security program?

   • AIT support staff
   • BSenior management
   • CSecurity analysts
   • DExternal auditors
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services firm has a policy that requires all employees to use strong passwords. The security team wants to provide practical advice on creating memorable but secure passwords, without making it mandatory. Which document should they publish?

   • AA revision to the password policy that includes the advice
   • BA security guideline that suggests using passphrases and password managers
   • CA security standard that mandates minimum password length and complexity
   • DA security procedure that outlines steps to reset a forgotten password
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational corporation has a security policy that requires all employees to complete annual security awareness training. The CISO wants to verify that this policy is being followed across all regional offices. Which monitoring method is most effective for this purpose?

   • AReviewing training completion reports from the learning management system (LMS)
   • BPerforming a vulnerability scan of the corporate network
   • CConducting a phishing simulation to test employee awareness
   • DReviewing the security policy annually to ensure it is up to date
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A cloud service provider is expanding into a new market and must comply with the EU's GDPR and the local data protection law, which is even stricter. The company's current data retention policy was designed for the US market and does not meet these requirements. The CISO must update the policy to ensure compliance. What is the best approach?

   • ACreate a separate data retention policy for the new market that only meets the local law
   • BAdopt the stricter local law as the baseline for the new market and adjust the global policy to meet both
   • CIgnore the local law because the company is based in the US
   • DKeep the current policy and add a disclaimer that it may not meet local laws
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has a security policy that requires all employees to use encrypted USB drives for data transfers. The security team wants to monitor compliance, but they are concerned that employees might use unencrypted personal drives. Which monitoring method would be most effective in detecting this violation?

   • AImplementing a DLP solution that blocks unencrypted USB devices
   • BConducting random spot checks of employee workstations
   • CRequiring employees to sign a form acknowledging the policy
   • DReviewing USB device logs from the endpoint management system
   Reveal Solution Discussion Select an answer first