A financial services firm has a security policy that has not been updated in three years. The company has since adopted a hybrid cloud infrastructure and new encryption standards. The compliance officer wants to ensure the policy remains effective. What is the most appropriate action?

Replace the entire policy with a new one based on the latest industry best practices.

Reissue the existing policy with a new effective date to demonstrate compliance.

Wait until the next scheduled annual review to avoid disrupting ongoing operations.

Schedule an immediate policy review to assess the impact of the hybrid cloud adoption and update the encryption standards accordingly.

A healthcare organization is updating its access-control policy to align with new regional privacy regulations. The legal team has confirmed that the regulation requires data minimization and explicit consent for data processing. The IT department wants to implement the policy with minimal disruption to clinical workflows. What is the most appropriate first step in the policy development process?

Conduct a needs assessment to identify current data access practices and gaps against the regulatory requirements.

Approve the policy based on the legal team's confirmation and then communicate it to all staff.

Draft the policy immediately using the legal team's interpretation of the regulation to save time.

Publish a preliminary policy to staff for immediate feedback before formal review.

A retail company has a security policy that states 'all customer data must be encrypted at rest.' The IT team needs to implement this requirement. Which document type should the IT team create to specify the exact encryption algorithms and key management procedures?

A procedure that outlines step-by-step instructions for encrypting data.

A guideline that recommends best practices for encryption and key management.

A new policy that replaces the existing encryption policy with more detail.

A standard that defines mandatory encryption algorithms and key management requirements.

A company's security policy states that 'all remote access must be secured.' The network team is implementing a new remote access solution and needs specific technical instructions on how to configure the VPN, including encryption algorithms and authentication methods. According to the policy hierarchy, what document should the network team consult for these specific technical requirements?

A standard, which provides mandatory technical requirements to support the policy.

The security policy, because it is the highest-level document and should contain all requirements.

A procedure, which outlines the step-by-step process for completing a task.

A guideline, which offers recommended practices for implementing the policy.

GIAC Strategic Planning, Policy, and Leadership

Domain 2Objective 1

Policy Development GSTRT Practice Questions (Page 6)

Part of the Policy and Program Management domain, which makes up ~45% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~32–54 in this domain), expect 8–14 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

8concepts

Questions 26–30

26application · medium
A financial services firm has a security policy that has not been updated in three years. The company has since adopted a hybrid cloud infrastructure and new encryption standards. The compliance officer wants to ensure the policy remains effective. What is the most appropriate action?
Select an answer first
27application · medium
A healthcare organization is updating its access-control policy to align with new regional privacy regulations. The legal team has confirmed that the regulation requires data minimization and explicit consent for data processing. The IT department wants to implement the policy with minimal disruption to clinical workflows. What is the most appropriate first step in the policy development process?
Select an answer first
28application · medium
A retail company has a security policy that states 'all customer data must be encrypted at rest.' The IT team needs to implement this requirement. Which document type should the IT team create to specify the exact encryption algorithms and key management procedures?
Select an answer first
29application · medium
A company's security policy states that 'all remote access must be secured.' The network team is implementing a new remote access solution and needs specific technical instructions on how to configure the VPN, including encryption algorithms and authentication methods. According to the policy hierarchy, what document should the network team consult for these specific technical requirements?
Select an answer first
30foundation · easy
Which section of a security policy describes the individuals or groups responsible for implementing and enforcing the policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSTRT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSTRT” is a trademark of its owner, used for identification only.

Policy Development GSTRT Practice Questions (Page 6)

Questions 26–30

A financial services firm has a security policy that has not been updated in three years. The company has since adopted a hybrid cloud infrastructure and new encryption standards. The compliance officer wants to ensure the policy remains effective. What is the most appropriate action?

A retail company has a security policy that states 'all customer data must be encrypted at rest.' The IT team needs to implement this requirement. Which document type should the IT team create to specify the exact encryption algorithms and key management procedures?

Which section of a security policy describes the individuals or groups responsible for implementing and enforcing the policy?

Keep studying — Policy and Program Management