Security Policies and Governance NDE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a key component of security governance?

   • ARisk management
   • BFirewall rule optimization
   • CDisk encryption
   • DLog analysis
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A cloud service provider stores personal data of EU citizens and must comply with GDPR. The company is updating its security policies to address data protection requirements. Which policy element is most directly required by GDPR?

   • AA policy that mandates weekly backups of all databases
   • BA policy that requires all employees to use two-factor authentication
   • CA policy that defines data protection impact assessments (DPIAs) for high-risk processing activities
   • DA policy that all data must be encrypted using AES-256
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the key difference between a security standard and a security guideline?

   • AStandards are mandatory, while guidelines are recommended
   • BStandards are for managers, while guidelines are for technicians
   • CStandards are high-level, while guidelines are technical
   • DStandards are optional, while guidelines are mandatory
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company has just approved a new remote-access policy. The security team must now ensure that all employees are aware of it and understand their responsibilities. What is the next stage in the policy lifecycle?

   • ADissemination, by communicating the policy to all employees and providing training
   • BDevelopment, by drafting a new policy
   • CReview, by sending the policy back to legal for another review
   • DMaintenance, by scheduling annual reviews of the policy
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A global company is subject to both GDPR and the Payment Card Industry Data Security Standard (PCI DSS). The security team is updating the data protection policy. GDPR requires data minimization, while PCI DSS requires retaining certain transaction data for audit purposes. How should the policy address this conflict?

   • ADefine a retention schedule that meets PCI DSS requirements while minimizing data to the extent required by GDPR
   • BRetain all transaction data indefinitely to satisfy PCI DSS
   • CDelete all transaction data immediately to comply with GDPR
   • DAsk the legal team to choose one regulation to follow
   Reveal Solution Discussion Select an answer first