Policy Management GSTRT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A software company's security policy requires that all code be reviewed by a second developer before deployment. The development team has a procedure that requires code review for all changes to the main branch. A recent incident occurred because a change was deployed to a feature branch without review, and that branch was later merged. What is the most appropriate action?

   • AUpdate the code-review procedure to require review of all changes to any branch that can be merged into the main branch.
   • BChange the policy to require code review only for changes to the main branch.
   • CRequire all developers to review their own code before merging.
   • DKeep the procedure unchanged and add a note that feature branches are not covered by the policy.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A financial institution has a security policy that requires all employees to use a VPN when working remotely. The policy was approved by the board, but the IT department has not updated the VPN procedure to reflect a new authentication method that was deployed last month. The new authentication method is more secure but requires employees to use a hardware token. Several employees have complained that the new procedure is confusing. What should the IT department do?

   • AKeep the new authentication method but do not update the procedure, and let employees figure it out.
   • BChange the policy to remove the VPN requirement and allow employees to work without a VPN.
   • CUpdate the VPN procedure to document the new authentication method and provide clear instructions to employees.
   • DRevert to the old authentication method to reduce employee confusion and maintain the existing procedure.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A government agency has a security policy that requires all employees to use a specific encrypted email service for sending sensitive information. The IT department has a procedure that describes how to configure the email service, but the procedure was written for an older version of the software. The new version has a different configuration interface. What should the IT department do?

   • AUpdate the procedure to match the new software version and verify that the configuration steps produce the required encryption.
   • BChange the policy to allow any email service that the IT department can configure.
   • CAsk the software vendor to provide a new procedure and adopt it without internal review.
   • DKeep the old procedure and train employees to adapt the steps to the new interface.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A regional bank is updating its security policies to align with a new state data-privacy regulation that requires customer financial data to be stored within the state's borders. The bank's current policy states that all data is stored in a single cloud region in a neighboring state. The CISO asks you to revise the policy. What is the most appropriate first step?

   • ARewrite the policy to mandate that all customer data be stored in an on-premises data center within the state.
   • BAdd a note to the existing policy that the neighboring-state cloud region is acceptable because it is within the same country.
   • CImmediately migrate all customer data to a new cloud region within the state before updating the policy.
   • DUpdate the policy to specify that customer financial data must reside in a data center located within the state, and note that cloud regions in the state are acceptable.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A non-profit organization has a security policy that was approved by the board of directors five years ago. The policy has not been reviewed since. The new executive director wants to ensure the policy is still relevant. What is the most appropriate action?

   • AReplace the policy with a new one based on a template from another non-profit.
   • BAsk the IT team to update the policy without involving the board.
   • CLeave the policy unchanged because it was approved by the board.
   • DConduct a formal review of the policy against current organizational goals and regulatory requirements, and update it as needed.
   Reveal Solution Discussion Select an answer first