Security Policies and Governance NDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A healthcare organization must align its security program with HIPAA and is defining how security decisions will be made and enforced across the enterprise. Which governance activity is most directly responsible for ensuring that security investments and policies support the organization's regulatory obligations?

   • ADeploying a new intrusion prevention system to detect and block malware across the network
   • BEstablishing a security steering committee that reviews and approves security strategy and major initiatives
   • CWriting a detailed incident response runbook for the security operations center
   • DConducting a one-time security awareness training session for all employees
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A regional bank must comply with a new data-protection regulation that requires customer data to be encrypted at rest and in transit. The CISO asks you to create a document that states the mandatory encryption requirements and defines the scope of systems affected. Which type of security policy document should you produce?

   • AA security procedure that provides step-by-step instructions for enabling encryption on each database
   • BA security guideline that recommends encryption best practices for the IT team
   • CAn issue-specific policy that mandates encryption for all customer data and identifies the systems in scope
   • DA system-specific policy that details the encryption configuration for each server and application
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A global company must comply with GDPR in Europe and CCPA in California. The security team is developing a data-privacy policy that must satisfy both regulations. The team is concerned that the policy may become too complex and difficult to enforce. What is the best approach?

   • AAdopt only the GDPR requirements because they are more comprehensive
   • BDevelop a single policy that meets the stricter requirements of both regulations and review it regularly
   • CUse a guideline instead of a policy to avoid regulatory conflicts
   • DCreate separate policies for each region and enforce them independently
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A small business has a security policy that requires 'all employees to use strong passwords.' The IT administrator has created a document that suggests using passphrases of at least 12 characters but does not make it mandatory. What type of document is this?

   • AA system-specific policy
   • BA security guideline
   • CA security procedure
   • DA security baseline
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A healthcare provider must comply with HIPAA and is updating its security policies. The provider wants to ensure that policies address the confidentiality, integrity, and availability of patient data. What should the policies include?

   • AA procedure for responding to patient complaints
   • BRequirements for access controls, encryption, and backup procedures
   • CA statement that all patient data must be stored on-premises
   • DA recommendation that employees use strong passwords
   Reveal Solution Discussion Select an answer first