Policy Management GSTRT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A university's acceptable-use policy (AUP) was written when all students used university-provided laptops. Now, most students bring personal devices, and the policy does not address personal-device usage on the campus Wi-Fi network. The security team has noticed an increase in malware infections on personal devices. What is the most appropriate action?

   • ABlock all personal devices from the campus Wi-Fi network until the policy is updated.
   • BSend a campus-wide email reminding students to use antivirus software on their personal devices.
   • CAssess the current AUP against the new personal-device reality and update it to define acceptable use and security requirements for personal devices.
   • DCreate a new technical standard for personal-device security and leave the AUP unchanged.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A technology startup has a security policy that was created by the founding team and has never been formally reviewed. The company has grown from 10 to 200 employees, and the policy does not cover cloud-based collaboration tools that are now widely used. The new CISO wants to establish a formal policy management process. What should the CISO do first?

   • AAsk each department to submit their own policies and compile them into a single document.
   • BHire a compliance consultant to rewrite all policies from scratch without involving internal stakeholders.
   • CSchedule a formal review of all existing policies with stakeholders and establish a recurring review cycle.
   • DWrite a new policy for cloud-based collaboration tools and distribute it to all employees immediately.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A hospital's security policy requires that all access to patient records be logged and reviewed monthly. The IT team has a procedure that reviews access logs for the electronic health record (EHR) system, but not for the lab information system (LIS), which also contains patient data. A recent audit found that a former employee accessed patient records in the LIS after termination. The CISO must decide how to address this. What is the most appropriate action?

   • AKeep the procedure unchanged and add a note that the LIS is not covered by the policy.
   • BImmediately revoke the former employee's access and take no further action.
   • CChange the policy to state that access reviews are required only for the EHR system.
   • DUpdate the access-review procedure to include the LIS, and conduct a one-time review of LIS logs to identify any other unauthorized access.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When a security policy is updated, what should happen to related security procedures?

   • AThey should be reviewed and updated to remain aligned
   • BThey should remain unchanged to ensure stability
   • CThey should be discarded immediately
   • DThey should be replaced by new policies
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   During a security policy assessment, what is the primary purpose of comparing existing policies against regulatory requirements and industry best practices?

   • ATo assign blame for policy violations
   • BTo replace all policies with industry best practices
   • CTo identify gaps and weaknesses in the current policy set
   • DTo justify the existing policy budget
   Reveal Solution Discussion Select an answer first