Security Management Controls GCIP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A small clinic is classified as a low-impact facility. The clinic stores limited patient data and has a single entrance. The clinic manager wants to improve security but has a limited budget. Which control should be implemented first?

   • ADeploy a biometric access control system
   • BInstall a monitored intrusion detection system
   • CHire a full-time security guard
   • DImplement a key control and access log for the single entrance
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is implementing a new security policy. The policy requires all employees to use multi-factor authentication (MFA). The senior manager is concerned about productivity impact. What is the senior manager's primary responsibility in this situation?

   • ADelay the policy until productivity concerns are fully resolved
   • BApprove the policy and ensure resources are allocated for implementation
   • CDelegate all decisions to the IT department
   • DTest the MFA solution personally before approving it
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has a security policy that requires all facilities to conduct quarterly security audits. A low-impact facility manager argues that quarterly audits are too resource-intensive for their site. The senior manager must decide. What is the best decision?

   • AExempt the low-impact facility from all security audits
   • BRevise the policy to specify audit frequency based on facility impact level
   • CAllow the low-impact facility to conduct annual audits instead
   • DRequire the low-impact facility to comply with the quarterly audit requirement
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A low-impact facility is updating its security policy. The facility has a small staff and limited IT support. Which policy component is most appropriate for this facility?

   • AA policy defining access control procedures for the facility's single entrance
   • BA policy mandating 24/7 security operations center monitoring
   • CA policy requiring quarterly penetration testing of all systems
   • DA policy requiring all employees to complete annual security awareness training
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a security audit, an organization discovers that several departments have independently created their own security rules, leading to inconsistent enforcement. The senior manager wants to establish a single, authoritative set of rules. What should the senior manager do?

   • AAllow each department to keep its own rules as long as they are documented
   • BDelegate the decision to the CISO without further involvement
   • CApprove a single organization-wide security policy and require all departments to align with it
   • DDirect the IT department to enforce the strictest department's rules everywhere
   Reveal Solution Discussion Select an answer first