Policy Development GSTRT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A manufacturing company is developing a policy for third-party vendor access to its network. The legal department has identified that the policy must align with a new data protection regulation. The IT team has drafted the policy and is now seeking input from key stakeholders. What is the next step in the policy development process?

   • AImplement the policy immediately and adjust it based on vendor feedback.
   • BPublish the draft policy to all vendors for immediate compliance.
   • CApprove the policy based on the IT team's draft and communicate it to vendors.
   • DConduct a formal review with legal, IT, and business stakeholders to refine the draft.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A multinational corporation has just approved a new data-classification policy. The policy introduces mandatory labeling for all documents and emails. The CISO is concerned that employees in different regions may not understand the new requirements. Which communication approach would most effectively support implementation across the organization?

   • ASend a single global email from the CISO with the policy attached and a deadline for compliance.
   • BDeploy role-based training modules in local languages, followed by a brief assessment and a recorded webinar for all staff.
   • CIssue a press release to external media to demonstrate the company's commitment to data protection.
   • DPublish the policy on the intranet and rely on managers to discuss it with their teams during weekly meetings.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A technology company has a policy requiring employees to use multi-factor authentication (MFA) for all remote access. An employee has repeatedly failed to enroll in MFA, citing inconvenience. The manager wants to enforce the policy consistently. Which action aligns with the policy hierarchy and enforcement principles?

   • AAsk the employee to sign a waiver acknowledging the risk of not using MFA.
   • BAllow the employee to use a longer password instead of MFA as a reasonable accommodation.
   • CProvide the employee with a temporary exemption while they adjust to the new requirement.
   • DRevoke the employee's remote access until MFA enrollment is completed, and document the action as a policy enforcement measure.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A software company is developing a new policy for handling customer data. The company is subject to the Payment Card Industry Data Security Standard (PCI DSS) because it processes credit card payments. During the policy drafting phase, the policy team is unsure how to handle the requirement for encrypting cardholder data at rest. What is the most appropriate source of guidance for this specific requirement?

   • AThe company's legal counsel, who can interpret the requirements of the standard.
   • BA security best-practice guideline from a technology vendor.
   • CThe PCI DSS standard itself, as it provides specific, mandatory requirements for protecting cardholder data.
   • DThe company's existing general data protection policy, as it is the authoritative internal document.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A regional bank is drafting a new remote-work security policy. The compliance team has identified that the policy must satisfy a contractual obligation requiring all customer data to remain within the country. The CISO wants the policy to be enforceable and to clearly define who can access customer data from home. Which two elements should the policy draft include to best address these requirements?

   • AA scope section stating the policy applies to all employees handling customer data, and a roles section naming the data owner and access approvers.
   • BA purpose section explaining the benefits of remote work, and a guidelines appendix recommending VPN use for all remote connections.
   • CA standards section listing approved encryption algorithms, and a procedures section detailing how to configure home routers.
   • DAn enforcement section describing disciplinary actions, and a review schedule stating the policy will be revisited annually.
   Reveal Solution Discussion Select an answer first