Managing Security Policy GSLC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company's security policy has not been reviewed in two years. The new security manager wants to establish a sustainable review cycle. What is the most important factor to consider?

   • ADelegate the review to a single policy owner without stakeholder input.
   • BSet a fixed review date regardless of organizational changes.
   • CReview the policy only when a major incident occurs.
   • DAlign the review cycle with the organization's risk assessment and business planning cycles.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has a policy that requires employees to use multi-factor authentication (MFA) for all remote access. The security team discovers that some employees are not using MFA. What is the most effective way to enforce the policy?

   • AImplement technical controls that block remote access without MFA
   • BIncrease the frequency of security awareness training
   • CDiscipline employees who do not use MFA
   • DSend a reminder email to all employees about the MFA requirement
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization is developing a new remote work security policy. The legal department has raised concerns about patient data privacy, while IT operations wants to ensure supportability. The security manager must ensure the policy is both compliant and practical. What is the most effective approach to policy development?

   • AInvolve legal, IT, and other key stakeholders in drafting and reviewing the policy
   • BDraft the policy using only legal input to ensure regulatory compliance
   • CAdopt a template from a similar healthcare organization
   • DHave the security team write the policy and then send it for approval
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What should be done with a security policy that is found to be outdated during a periodic review?

   • AUpdate the policy to reflect current risks and operational needs
   • BLeave the policy unchanged to avoid confusion
   • CArchive the policy and stop enforcing it
   • DImmediately retire the policy without a replacement
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How often should security policies be reviewed to remain current?

   • AOnce, immediately after implementation
   • BOnly when new regulations are enacted
   • COn a regular schedule, such as annually, and after significant changes
   • DOnly when a security incident occurs
   Reveal Solution Discussion Select an answer first