Security Management Controls GCIP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a key component typically found in a well-structured security policy?

   • AA statement of scope, roles and responsibilities, and compliance requirements
   • BA list of specific software versions approved for use
   • CA step-by-step incident response playbook
   • DA detailed network diagram with IP addresses
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company's security policy requires all employees to report security incidents to the security team. However, a senior manager in a low-impact facility believes that minor incidents do not need to be reported. What is the best way to handle this situation?

   • AReinforce that the policy applies to all incidents and that the manager is accountable for compliance
   • BIgnore the manager's behavior because the facility is low-impact
   • CChange the policy to only require reporting of major incidents
   • DAllow the manager to decide which incidents to report
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A regional water utility is updating its security governance framework. The board of directors has approved a new security policy, but the IT manager is unsure who has the authority to approve exceptions to the policy. According to the organization's security management structure, which role should be designated as the owner of the exception approval process?

   • AThe external auditor
   • BThe board of directors
   • CThe senior manager responsible for the policy
   • DThe Chief Information Security Officer (CISO)
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A hospital is revising its security policies to comply with healthcare regulations. The compliance officer notes that the current policy is vague and does not specify who is responsible for patient data protection. What is the best way to improve the policy?

   • AAdd a section that assigns specific security roles and responsibilities to named positions
   • BReplace the policy with a detailed technical standard
   • CRemove all technical details to keep the policy high-level
   • DHave each department create its own policy
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An organization has a security policy that requires all employees to report security incidents within one hour. A low-impact facility employee discovers a minor incident but is unsure if it qualifies. The employee delays reporting for two days. What is the most likely reason for the delay?

   • AThe policy does not clearly define what constitutes a security incident
   • BThe employee did not have access to a phone or computer
   • CThe employee was not aware of the policy
   • DThe employee was afraid of disciplinary action
   Reveal Solution Discussion Select an answer first