Managing Security Policy GSLC Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A multinational corporation is updating its information security policies. The board of directors wants to ensure that the policies support business objectives while managing risk. Which governance structure best supports this alignment?

   • ALet the security team set policies independently to maintain technical rigor
   • BAdopt industry-standard policies without modification
   • CDelegate all policy decisions to the IT department
   • DEstablish a steering committee with representation from business units, legal, and security
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A manufacturing company has a security policy that was written five years ago and has never been updated. The policy still references obsolete technologies and does not address current cloud collaboration tools that employees now use. The security manager wants to bring the policy in line with current operations. What is the most appropriate first step in the policy lifecycle?

   • ARetire the existing policy and draft a new one from scratch
   • BSchedule a formal review of the policy with stakeholders to assess needed changes
   • CCommunicate the existing policy to all employees to ensure awareness
   • DImmediately update the policy to include cloud collaboration tools
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A company has a policy that requires all employees to complete security awareness training annually. Compliance is low because employees say they do not have time. The security manager wants to improve compliance without reducing the training's effectiveness. Which approach is best?

   • ABreak the training into short, mandatory modules that can be completed during work hours, and track completion automatically.
   • BMake the training optional but provide incentives for completion.
   • CReduce the training to a short quiz that can be completed in five minutes.
   • DCancel the training because employees are too busy.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An organization has implemented a new policy requiring data classification labels on all documents. Employees are ignoring the labels. The security manager wants to improve compliance. What is the most effective action?

   • AIgnore the issue until the next audit
   • BAdd the requirement to the employee handbook
   • CAutomatically apply labels using a technical tool
   • DProvide training on how to classify documents and explain why it matters
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A software company is retiring an old remote-access policy and replacing it with a new one. What should the security manager do to ensure a smooth transition?

   • ASilently replace the old policy on the intranet and delete all references to it.
   • BCommunicate the retirement date of the old policy, publish the new policy, and provide training on the changes.
   • CKeep the old policy active alongside the new one until the next audit.
   • DAnnounce the new policy only after the old one has been fully retired.
   Reveal Solution Discussion Select an answer first