Policy Management GSTRT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A bank's security policy requires that all changes to the production environment be approved by the change advisory board (CAB). The DevOps team has a procedure that allows automated deployments to production without CAB approval for low-risk changes. The security team's audit found that a low-risk change caused a data breach. The CISO must reconcile the policy with the DevOps team's need for speed. What is the most appropriate action?

   • AKeep the current procedure unchanged and accept the risk because the change was low-risk.
   • BRequire all changes, including low-risk ones, to go through the full CAB approval process.
   • CUpdate the policy to define criteria for low-risk changes that can bypass CAB approval, and require a post-deployment review.
   • DRemove the CAB approval requirement from the policy and let the DevOps team decide what is low-risk.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A manufacturing company has a security policy that requires all remote access to the corporate network to be protected by multi-factor authentication (MFA). The current procedure for remote access only requires a VPN connection with a username and password. The IT team is about to deploy a new MFA solution. What should the IT team do to ensure the procedure aligns with the policy?

   • AChange the policy to remove the MFA requirement since the current procedure is working without it.
   • BCreate a separate procedure for MFA and leave the existing remote access procedure unchanged.
   • CDeploy the MFA solution and assume that the existing procedure will work with the new authentication method.
   • DUpdate the remote access procedure to include the MFA step and communicate the change to all remote users.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A healthcare organization's incident-response policy was last reviewed two years ago. After a recent ransomware attack, the post-incident review identified that the policy did not clearly define when to involve law enforcement, and the response team wasted time debating this during the incident. The CISO wants to prevent this from recurring. What should you do?

   • AAdd a section to the policy that lists specific criteria for mandatory law-enforcement notification, then schedule a quarterly review of the policy.
   • BCreate a new procedure document for law-enforcement notification and leave the policy unchanged.
   • CReplace the incident-response policy with a new version that requires law-enforcement notification for every incident.
   • DTrain the incident-response team on the existing policy and emphasize that law enforcement should always be contacted immediately.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the relationship between security procedures and security policies?

   • AProcedures are independent of policies
   • BProcedures support and implement policies
   • CProcedures replace policies
   • DProcedures are only for auditors
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A multinational corporation has a security policy that was approved by the CISO and distributed via email to all employees two years ago. Since then, the company has acquired two smaller firms and adopted a new cloud-based HR system. The security team notices that employees from the acquired firms have not received the policy, and the HR system's data handling practices are not covered by the existing policy. What should the security team do to address this situation?

   • ARe-issue the existing policy to all employees, including those from the acquired firms, and add a section about the HR system.
   • BArchive the old policy and rely on the new HR system's vendor documentation to guide data handling practices.
   • CCreate a new policy specifically for the HR system and distribute it only to HR staff and the acquired firms.
   • DReview and update the existing policy to cover the new HR system, then re-issue it through a formal approval and distribution process to all employees.
   Reveal Solution Discussion Select an answer first