Policy Development GSTRT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A university is creating a policy for acceptable use of its research computing resources. The policy must clearly state what happens if a researcher violates the policy. Which component is essential to include in the policy?

   • AA roles section that names the system administrators responsible for the resources.
   • BA scope section that lists all research departments covered by the policy.
   • CAn enforcement section that describes the consequences for non-compliance, such as loss of access or disciplinary action.
   • DA purpose section that explains the importance of research computing resources.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has a policy that requires all employees to report security incidents within 24 hours. An employee discovers a potential data breach but does not report it for a week because they were unsure if it was a real incident. The breach is later confirmed, and the company faces regulatory fines. The CISO is reviewing the policy to prevent this from happening again. What is the most effective change to the policy?

   • AIncrease the penalty for failing to report an incident.
   • BShorten the reporting window from 24 hours to 12 hours.
   • CClarify the definition of a security incident and provide examples in the policy.
   • DRequire all employees to complete a security awareness training module on incident reporting.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of a regulatory requirement that may influence a security policy?

   • AThe General Data Protection Regulation (GDPR)
   • BThe organization's marketing strategy
   • CThe company's internal dress code
   • DThe CEO's personal preference
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a security policy that was developed three years ago. Since then, the company has adopted a zero-trust architecture and moved to a hybrid cloud environment. The policy still references a traditional perimeter-based security model. The CISO wants to update the policy but is facing resistance from the board, which is concerned about the cost and effort of a full policy rewrite. The CISO must balance the need for an updated policy with the board's concerns. What is the most effective approach?

   • ACreate a new, separate policy for zero-trust and hybrid cloud, leaving the old policy in place.
   • BUpdate only the sections of the policy that directly relate to the new architecture.
   • CConduct a full policy review and rewrite, presenting the business case for the update to the board.
   • DIssue a series of policy exceptions for the new zero-trust and hybrid cloud initiatives.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which method is most effective for ensuring that employees understand a new security policy?

   • APosting the policy on the company intranet
   • BSending a single email
   • CMaking the policy available upon request
   • DConducting mandatory training sessions
   Reveal Solution Discussion Select an answer first