Managing Security Policy GSLC Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which method is commonly used to measure compliance with a security policy?

   • AConducting regular audits and reviews of system configurations
   • BRelying on the number of policies published
   • CReviewing the policy document's version history
   • DAsking employees to self-report their compliance
   Reveal Solution Discussion Select an answer first
2. 32application · medium · select all that apply

   A security manager is implementing a new remote work policy. Which actions are effective for ensuring employees understand and comply? (Select all that apply.)

   • ARequire employees to sign an acknowledgment of the policy
   • BAssume employees will read the policy on their own
   • CPost the policy on the company intranet
   • DImplement technical controls that enforce the policy
   • EProvide training sessions that explain the policy and its rationale
   Check answers Discussion Select an answer first
4. 33application · medium · select all that apply

   A company is developing a new security policy. Which steps are essential in the policy development process? (Select all that apply.)

   • AIdentify the business objectives the policy supports
   • BCommunicate the policy to all affected employees
   • CWrite the policy without external input to save time
   • DConsult with relevant stakeholders, such as legal and IT
   • EObtain formal approval from management or governance
   Check answers Discussion Select an answer first
5. 34application · medium

   A multinational corporation is establishing a security policy governance structure. The goal is to ensure that policies align with business objectives while remaining compliant with regional regulations. Which governance model is most effective?

   • AUse an external consulting firm to write all policies and approve them without internal review.
   • BCreate a cross-functional policy committee with representatives from security, legal, compliance, and business units that meets quarterly to review and approve policies.
   • CAllow each regional office to develop its own policies independently to meet local regulations.
   • DDelegate all policy decisions to the CISO to ensure consistency and speed.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A manufacturing company is drafting a new remote-access policy. The CISO wants the policy to reflect input from IT operations, legal, and HR, and to be formally approved before publication. Which approach best aligns with the policy development process?

   • ACreate the policy based on a template from a peer company and publish it immediately to save time.
   • BDraft the policy with the security team, then send it to IT, legal, and HR for review, and route the final version to the executive committee for approval.
   • CAsk IT operations to draft the policy, then publish it after a quick review by the security team.
   • DHave the CISO draft and approve the policy alone to avoid delays and ensure consistency with security strategy.
   Reveal Solution Discussion Select an answer first