Security Policies and Governance NDE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization's security policy mandates that 'all software patches must be applied within 7 days of release.' The IT team has created a document that describes the exact steps to test, approve, and deploy patches. What is the primary purpose of this document?

   • ATo establish a baseline for system configuration
   • BTo define the security policy for patch management
   • CTo serve as a guideline for best practices in patching
   • DTo provide a step-by-step process that implements the patch management policy
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial firm is updating its data retention policy to comply with new regulations. The CISO has drafted the new policy and now needs to ensure it is formally adopted and communicated. What is the next step in the policy lifecycle?

   • ASubmit the policy to the board of directors for review and approval
   • BImmediately distribute the policy to all employees via email
   • CConduct a risk assessment to evaluate the policy's impact
   • DImplement the policy by updating all system configurations
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A regional bank has a security policy that states 'all remote access must be protected by strong authentication.' The security team is now selecting a specific technology and configuration for the VPN concentrators. Which document type should the team consult to find the exact technical settings that must be enforced?

   • AA security baseline specifying the encryption algorithms and authentication methods for VPN devices
   • BA security procedure that outlines the step-by-step process for onboarding new remote users
   • CAn issue-specific policy on remote access that lists acceptable use cases and approval workflows
   • DA security guideline recommending multi-factor authentication for remote access
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is implementing a new policy that requires 'all endpoints to be patched within 72 hours of a critical patch release.' The team has created a baseline that specifies the patch management settings. However, some business units argue that the baseline is too restrictive and prevents them from using certain legacy applications. What is the best way to handle this conflict?

   • ACreate an exception process within the baseline that allows temporary deviations with risk acceptance
   • BChange the policy to allow 30 days for patching
   • CForce all business units to comply with the baseline without exceptions
   • DRemove the baseline and rely on the policy alone
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A retail company has a policy that 'all customer data must be encrypted during transmission.' The security team is now deciding whether to use TLS 1.2 or TLS 1.3 and which cipher suites to enable. Which document should the team update to reflect this decision?

   • AThe incident response procedure
   • BThe organizational security policy
   • CThe acceptable use policy
   • DThe security baseline for web servers
   Reveal Solution Discussion Select an answer first