Security Policies and Governance NDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company's security policy requires that all terminated employees have their access revoked within two hours. The IT team has created a document that lists the exact steps: notify HR, disable the Active Directory account, revoke VPN certificates, and log the action. What is this document?

   • AA system-specific policy
   • BA security baseline
   • CA security procedure
   • DA security guideline
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security policy that defines the acceptable use of email and internet access for all employees is best classified as which type of security policy?

   • AIssue-specific security policy
   • BRegulatory compliance policy
   • CSystem-specific security policy
   • DOrganizational security policy
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is expanding into a new market that has strict data residency laws. The security governance committee must decide how to update the security strategy to comply with these laws while maintaining operational efficiency. What is the most effective governance action?

   • AImmediately move all data to the new region to comply with the law
   • BConduct a risk assessment to understand the legal requirements and update the security strategy accordingly
   • CIgnore the law because the company's current security measures are sufficient
   • DDelegate the decision to the IT operations team without governance oversight
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   Your organization's security policy states that all workstations must have antivirus software installed. The IT team needs a concrete set of minimum configuration settings to enforce this policy consistently across different hardware models. What should the team use?

   • AA security baseline that specifies the required antivirus version, update frequency, and scan settings
   • BA security guideline that suggests antivirus best practices for IT staff
   • CAn issue-specific policy that reiterates the antivirus requirement
   • DA security procedure that explains how to install antivirus software step by step
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A hospital has a policy that 'all access to patient records must be logged and monitored.' The IT department is now deciding which specific logging tools and monitoring thresholds to use. Which document should be updated to include these technical details?

   • AThe system-specific security policy for the electronic health record system
   • BThe organizational security policy
   • CThe incident response plan
   • DThe security awareness training material
   Reveal Solution Discussion Select an answer first