Policy Development GSTRT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which security principle is primarily concerned with ensuring that data is not altered or destroyed by unauthorized parties?

   • ANon-repudiation
   • BIntegrity
   • CConfidentiality
   • DAvailability
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A security policy requires multiple layers of control, such as firewalls, antivirus, and user training. Which security principle does this approach exemplify?

   • AFail-safe defaults
   • BLeast privilege
   • CSeparation of duties
   • DDefense in depth
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A financial services firm has a security policy that was last reviewed three years ago. Since then, the company has migrated to a multi-cloud environment and adopted a DevOps model. The policy still references on-premises data centers and does not address cloud security responsibilities. An internal audit has identified this as a significant gap. What is the most appropriate action for the CISO to take?

   • AIssue a temporary exception to the existing policy until a new one can be written.
   • BRevise the policy informally by updating the references to data centers with cloud providers.
   • CInitiate a full policy review cycle to update the policy to reflect the current cloud and DevOps environment.
   • DCreate a new policy specifically for cloud security and leave the existing policy unchanged.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which mechanism is commonly used to enforce a security policy?

   • ATechnical controls such as access control lists
   • BRelying solely on employee goodwill
   • CIgnoring minor violations
   • DPosting the policy once
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company has a policy that requires all employees to complete security awareness training annually. An employee has failed to complete the training for two consecutive years. The employee's manager is unsure how to handle this situation. According to the policy, which of the following is the most appropriate action for the manager to take?

   • ARevoke the employee's network access until the training is completed.
   • BIgnore the issue because the employee is a top performer and the training is not critical to their role.
   • CEscalate the issue to the HR department for disciplinary action as outlined in the policy.
   • DGive the employee a verbal warning and allow them to complete the training by the end of the quarter.
   Reveal Solution Discussion Select an answer first