Security Policies and Governance NDE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A manufacturing company has a security policy that requires all USB ports on workstations to be disabled. The IT team needs to implement this policy, but some employees legitimately need to use USB devices for specific machines. The team must balance security with operational needs. What should the team do?

   • ACreate a system-specific policy that allows USB use on approved machines and a procedure for requesting exceptions
   • BImplement a security baseline that disables USB ports on all systems
   • CDisable USB ports on all workstations without exception
   • DReplace the organizational policy with a guideline that recommends disabling USB ports
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of a security policy in an organization?

   • ATo define management's intent and direction for protecting information assets
   • BTo list every possible threat and vulnerability
   • CTo provide step-by-step instructions for configuring firewalls
   • DTo replace the need for technical security controls
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company's security policy requires that all employees use multi-factor authentication (MFA). The IT team has implemented MFA, but some employees are complaining that it is inconvenient. The company wants to maintain security while improving user acceptance. What should the company do?

   • ACreate a procedure that disables MFA for users who complain
   • BChange the policy to require MFA only for remote access
   • CKeep the MFA policy and provide a guideline that recommends using biometric or push-based MFA methods
   • DRemove the MFA requirement and rely on strong passwords
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A new security policy has been drafted to address remote work risks. Before it can take effect, the legal team must review it, the CISO must approve it, and employees must be trained on it. What is the correct sequence of lifecycle stages for this policy?

   • AApproval, development, dissemination, review, and maintenance
   • BDevelopment, review, approval, dissemination, and maintenance
   • CReview, approval, development, dissemination, and maintenance
   • DDissemination, development, approval, review, and maintenance
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A government agency is required to comply with FISMA and is establishing a security governance structure. Which activity is most directly part of security governance?

   • AInstalling endpoint protection software on all workstations
   • BConfiguring a SIEM to collect logs from all systems
   • CPerforming a vulnerability scan on the network
   • DDeveloping a risk management framework that aligns with FISMA requirements
   Reveal Solution Discussion Select an answer first