Managing Security Policy GSLC Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company's security policy review committee is divided: some members want to update the policy immediately due to a new threat, while others want to wait for the scheduled annual review. The CISO must decide. What is the best approach?

   • AConduct an out-of-cycle review focused on the new threat and update the policy if necessary.
   • BWait for the annual review to avoid disrupting the policy lifecycle.
   • CImmediately rewrite the entire policy to address the new threat.
   • DIgnore the new threat because it is not yet proven.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A healthcare organization's security policy review is due. The compliance officer wants to ensure the policy still meets regulatory requirements. Which action should be part of the review process?

   • AArchive the policy and create a new one from scratch every year.
   • BReview the policy only if a security incident has occurred.
   • CAsk the policy owner to confirm the policy is still accurate without further analysis.
   • DCompare the policy against current regulations and industry standards, and document any gaps.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A large enterprise is restructuring its security governance. Currently, each business unit creates its own security policies, leading to inconsistencies and gaps. The CISO wants to improve governance. What is the most effective change?

   • AAdopt a single industry-standard policy framework for all units
   • BCreate a centralized policy governance committee to oversee all security policies
   • CEliminate business unit policies and rely on the corporate policy only
   • DAllow business units to continue but require them to share policies with the CISO
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A multinational corporation has a policy that all personal data must be stored in the region where the data subject resides. The company's cloud provider offers regions in multiple countries. The security team is tasked with enforcing this policy. What is the most effective technical control?

   • AAsk employees to manually select the correct region when creating resources.
   • BStore all data in the company's headquarters region to simplify management.
   • CRely on the cloud provider's default settings, assuming they comply with the policy.
   • DConfigure cloud resource policies that restrict data storage to approved regions and use data residency features.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization's security policy on data retention was created before the adoption of cloud storage. The policy does not address data stored in cloud services. The security manager needs to ensure the policy remains relevant. What is the best course of action?

   • ARetire the policy and rely on cloud provider documentation
   • BCreate a separate policy for cloud storage and leave the existing policy unchanged
   • CSchedule a periodic review of the policy to incorporate cloud storage requirements
   • DAssume the policy applies to cloud storage by default
   Reveal Solution Discussion Select an answer first