Security Policies and Governance NDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An organization's security policy requires that all servers be patched within 30 days of a vendor release. The IT team is struggling to meet this deadline because some legacy servers cannot be patched without causing application downtime. The team must find a way to comply with the policy while minimizing operational disruption. What should the team do?

   • AIgnore the policy for legacy servers and patch them when convenient
   • BCreate a system-specific policy for legacy servers that defines a longer patching window and compensating controls
   • CApply the patch to all servers immediately, even if it causes downtime
   • DChange the organizational policy to allow 60 days for all servers
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A large enterprise has a security policy that mandates 'all remote access must use multi-factor authentication.' The security team is evaluating two solutions: one that uses a hardware token and one that uses a mobile app. The policy does not specify which method to use. The team needs to enforce a consistent standard across the organization. What should they do?

   • AAllow each department to choose its preferred MFA method
   • BRevise the policy to include the specific MFA method
   • CCreate a guideline that recommends one method over the other
   • DUpdate the security baseline to specify the approved MFA methods and configurations
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An organization's security policy requires that all laptops be encrypted. The IT team has deployed full-disk encryption, but some users have reported that their laptops are slow after the encryption was applied. The team must maintain the policy while addressing performance concerns. What should the team do?

   • AChange the policy to require encryption only for laptops that contain sensitive data
   • BUpdate the security baseline to specify hardware that supports encryption acceleration and provide a procedure for upgrading older laptops
   • CProvide a guideline that recommends disabling encryption on older laptops
   • DRemove encryption from laptops that are slow
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A multinational company is subject to the EU General Data Protection Regulation (GDPR) and must update its security policies. Which legal requirement must the policy explicitly address to remain compliant?

   • AA policy that all employees must sign a non-disclosure agreement annually
   • BMandatory use of a specific encryption algorithm for all data at rest
   • CProcedures for reporting personal data breaches to the supervisory authority within 72 hours
   • DA requirement to store all personal data only within the European Union
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A cloud service provider hosts customer data and must comply with both GDPR and the customer's contractual requirements. The provider's security policy states that data will be encrypted at rest, but a customer requires that encryption keys be managed exclusively by the customer. The provider's current key management system gives the provider access to the keys. What should the provider do?

   • ARefuse the customer's requirement because GDPR requires the provider to control keys
   • BOffer a customer-managed key option and update the security policy to include this option
   • CContinue using the current key management system and inform the customer that it meets GDPR
   • DEncrypt the data with the provider's keys and store the keys in a separate location
   Reveal Solution Discussion Select an answer first