Managing Security Policy GSLC Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company has a policy requiring all employees to complete security awareness training annually. Compliance is currently at 60%. The security manager wants to increase compliance to 95% within six months. The budget is limited. Which strategy is most effective?

   • ASend a series of reminder emails to all employees
   • BShorten the training to 15 minutes to reduce the time burden
   • CMake training mandatory and automatically enroll all employees, with manager follow-up for non-completers
   • DOffer a small incentive, such as a gift card, for completing the training
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A financial services firm has just approved a new clean-desk policy. To maximize compliance, which implementation step should the security manager take FIRST?

   • ACommunicate the policy through multiple channels, such as email, intranet, and team meetings, and provide a clear effective date.
   • BAsk each department manager to verbally remind their team about the policy during the next staff meeting.
   • CUpdate the policy to include specific penalties for non-compliance before telling employees.
   • DImmediately begin auditing desks and issuing warnings to employees who do not comply.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A non-profit organization has a security policy that is approved by the board, but the IT manager has been making exceptions without formal approval. The executive director wants to maintain flexibility while ensuring accountability. What is the best governance approach?

   • AEstablish a formal exception process that documents the rationale, risk, and approval for each deviation.
   • BProhibit all exceptions to the policy.
   • CReview each exception at the next board meeting without a formal process.
   • DAllow the IT manager to continue making exceptions as long as they are documented in email.
   Reveal Solution Discussion Select an answer first
5. 44application · medium · select all that apply

   A company has a policy that prohibits the use of unauthorized software. The security team wants to enforce this policy and measure compliance. Which actions are effective methods? (Select all that apply.)

   • AImplement application whitelisting to block unauthorized software
   • BConduct periodic audits of installed software
   • CUse endpoint detection tools to report software inventory
   • DSend a memo reminding employees of the policy
   • ERely on employees to self-report unauthorized software
   Check answers Discussion Select an answer first
6. 45expert · hard

   A technology company has a policy that requires all code changes to be reviewed by a security engineer. The policy is frequently bypassed because there are not enough security engineers to review every change. What is the best solution to improve compliance without overburdening the security team?

   • ARequire developers to self-certify that their code is secure without review.
   • BRemove the policy because it is impractical and creates bottlenecks.
   • CImplement automated security scanning in the CI/CD pipeline and require manual review only for high-risk changes.
   • DIncrease the number of security engineers to match the volume of code changes.
   Reveal Solution Discussion Select an answer first