Policy Development GSTRT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security architect is developing a new policy for protecting sensitive research data. The policy must ensure that data is not altered without authorization and that it is available to authorized researchers when needed. The architect is considering which security principles to emphasize in the policy. Which pair of principles is most directly addressed by these requirements?

   • AConfidentiality and integrity.
   • BConfidentiality and non-repudiation.
   • CAvailability and accountability.
   • DIntegrity and availability.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A large healthcare organization has just approved a new remote work policy that mandates the use of a specific VPN client and prohibits the storage of patient data on local devices. The policy is set to take effect in 30 days. The IT department is concerned that employees will not comply because they are used to working from home without a VPN. What is the most effective first step to ensure successful implementation and compliance?

   • AConduct mandatory training sessions and provide a grace period before enforcing the technical controls.
   • BPublish the policy on the company intranet and rely on managers to communicate it to their teams.
   • CImmediately disable all non-compliant remote access methods and block local storage of patient data.
   • DSend a single email to all employees outlining the new policy and the date it takes effect.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A multinational company is drafting a new data classification policy. The legal team has identified that the company must comply with the EU General Data Protection Regulation (GDPR) for its European operations and the California Consumer Privacy Act (CCPA) for its US operations. During the needs assessment phase, the policy working group discovers that the two regulations have conflicting requirements for data retention periods. What is the most appropriate action for the policy team to take during the drafting phase?

   • ADraft separate regional policy addendums that address the specific retention requirements of each regulation.
   • BAdopt the least restrictive requirement to minimize operational impact and document the risk acceptance.
   • CDraft a single global policy using the most restrictive retention requirement from either regulation.
   • DDefer the retention requirement to a standard that can be updated independently of the policy.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A new data retention policy has been approved and published. The policy requires that all customer data be deleted after 7 years. The IT team is now responsible for implementing this policy. What is the most critical action the IT team should take to ensure the policy is effectively implemented?

   • ASend an email to all employees informing them of the new policy.
   • BImmediately delete all customer data that is older than 7 years.
   • CWait for the legal department to provide further guidance on the policy.
   • DCreate a technical procedure for data deletion and schedule regular audits to verify compliance.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is an appropriate consequence for a first-time, minor violation of a security policy?

   • AVerbal warning and additional training
   • BImmediate termination
   • CNo action
   • DPublic humiliation
   Reveal Solution Discussion Select an answer first