Security Policies and Governance NDE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is preparing for an external audit. The auditor asks to see evidence that the company's security policies are being followed. The company has policies, but there is no formal process for tracking compliance. What should the company do to prepare for the audit?

   • ADelay the audit until a compliance process is developed
   • BCreate new policies that are easier to comply with before the audit
   • CImplement a compliance monitoring process that documents policy adherence and generates reports
   • DProvide the auditor with the policy documents only
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A manufacturing company is establishing a security governance program. The board of directors wants to ensure that security risks are managed consistently and that the organization meets industry regulations. Which action is the most direct example of security governance?

   • AUpdating antivirus signatures on all endpoints
   • BCreating a security risk management framework that defines risk tolerance and reporting lines
   • CInstalling firewalls on all network segments
   • DConducting a penetration test on the corporate web application
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which document would an IT administrator most likely consult to perform the exact steps for resetting a user's password?

   • ASecurity policy
   • BSecurity procedure
   • CSecurity standard
   • DSecurity guideline
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A small business does not have a formal security policy but wants to give its employees practical advice on creating strong passwords and recognizing phishing emails. What should the business provide?

   • AA security baseline that sets minimum password length and complexity
   • BA system-specific policy that applies to each employee's computer
   • CA security procedure that details how to reset a forgotten password
   • DA security guideline that offers best practices for password creation and phishing awareness
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is updating its security policies to comply with a new regulation. The legal team has approved the changes, but the IT team is concerned that some requirements are not technically feasible. The policy is scheduled to be disseminated next week. What should the security team do?

   • AReopen the review stage to address the IT team's concerns before approval
   • BArchive the policy and start over from development
   • CProceed with dissemination and address the concerns after the policy is in effect
   • DSkip the approval stage and implement the policy as is
   Reveal Solution Discussion Select an answer first