Policy Management GSTRT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A startup company has grown rapidly and now has 500 employees. The company's security policies were written when there were 20 employees and are informal. The CISO wants to formalize the policy-management process. The company has limited resources and cannot hire a dedicated policy manager. What is the most appropriate approach?

   • AAdopt a set of industry-standard policies from a template and do not modify them.
   • BEstablish a policy review committee with representatives from key departments, and schedule annual reviews for all policies.
   • CPurchase a policy-management software tool and assume it will handle the review process automatically.
   • DAssign the task of updating all policies to the most senior security engineer, and have them review policies as time permits.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A logistics company has a security policy that was approved by the board of directors five years ago. Since then, the company has adopted a bring-your-own-device (BYOD) policy, but the security policy has not been updated to address mobile device security. The security team wants to ensure the policy remains current. What should the security team do?

   • AWait for the next annual review cycle to update the policy, even if it is several months away.
   • BInitiate a formal review of the security policy with stakeholders to incorporate mobile device security requirements.
   • CCreate a separate mobile device security policy and leave the main security policy unchanged.
   • DSend a memo to all employees reminding them to secure their personal devices.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization's security policy requires annual security awareness training for all staff. After a recent phishing simulation, the security team finds that 30% of employees clicked on a simulated phishing email. The policy does not address how to handle employees who fail phishing simulations. The organization wants to improve its security posture. What should the security team do?

   • AIncrease the frequency of phishing simulations to monthly and hope that employees learn from repeated exposure.
   • BUpdate the policy to include a mandatory retraining and re-testing process for employees who fail phishing simulations.
   • CTerminate employees who clicked on the simulated phishing email to send a strong message to the rest of the staff.
   • DRemove the annual training requirement from the policy and replace it with a quarterly email reminder about phishing risks.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which activity is most directly associated with the security policy assessment process?

   • ADecommissioning obsolete hardware
   • BComparing current policies to regulatory requirements
   • CApproving a new policy for publication
   • DTraining employees on policy updates
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's security policy requires that all employees complete security awareness training annually. The HR department has a procedure that schedules training for new employees within 30 days of hire, but it does not schedule annual refresher training for existing employees. What is the most appropriate action?

   • ACreate a separate policy for annual refresher training and leave the existing procedure unchanged.
   • BUpdate the HR procedure to include annual refresher training for all existing employees.
   • CKeep the procedure unchanged and rely on new-employee training only.
   • DChange the policy to require training only for new employees.
   Reveal Solution Discussion Select an answer first