Policy Management GSTRT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A technology company's security policy requires that all software vulnerabilities be patched within 30 days. The operations team has a procedure that patches critical vulnerabilities within 7 days and non-critical ones within 60 days. The security team's quarterly review found that the 60-day window for non-critical patches is causing some systems to miss the policy deadline. What is the most appropriate action?

   • AUpdate the patching procedure to require all vulnerabilities to be patched within 30 days, aligning it with the policy.
   • BKeep the procedure unchanged and accept that some systems miss the deadline.
   • CCreate a separate policy for non-critical vulnerabilities with a 60-day patch window.
   • DChange the policy to allow 60 days for non-critical vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial services firm's security policy requires that all sensitive data be encrypted at rest. The storage team has a procedure that encrypts all production databases but does not encrypt backup tapes. An internal audit found that backup tapes are stored offsite and contain sensitive data. What is the most appropriate action?

   • AKeep the backup procedure unchanged and rely on the offsite storage facility's physical security.
   • BCreate a new policy specifically for backup tapes and leave the existing encryption policy unchanged.
   • CChange the policy to state that encryption at rest applies only to production databases.
   • DUpdate the backup procedure to include encryption of backup tapes, and verify that the procedure aligns with the policy.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An e-commerce company's security policy requires that all customer data be encrypted in transit using TLS 1.2 or higher. The web operations team has a procedure that configures TLS 1.2 on all public-facing web servers. A recent security assessment found that some internal APIs still use TLS 1.0. The CISO must decide how to address this. What is the most appropriate action?

   • AImmediately disable TLS 1.0 on all internal APIs without a remediation plan.
   • BUpdate the web-operations procedure to include internal APIs, and schedule a remediation project to upgrade all internal APIs to TLS 1.2.
   • CChange the policy to allow TLS 1.0 for internal APIs because they are not public-facing.
   • DKeep the procedure unchanged and document that internal APIs are out of scope.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which process is part of the security policy management lifecycle?

   • ACreating, approving, disseminating, and maintaining policies
   • BConducting penetration tests on production systems
   • CPurchasing security software licenses
   • DMonitoring network traffic for anomalies
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A software company's password policy requires 12-character passwords changed every 90 days. The security team's annual review found that the password-change requirement is causing users to write down passwords, increasing risk. The team also reviewed current industry guidance, which recommends against forced periodic changes. What is the most appropriate action?

   • AKeep the policy unchanged because it meets the original security requirements.
   • BRemove the periodic password-change requirement from the policy and instead require 12-character passwords with multi-factor authentication.
   • CChange the policy to require password changes every 30 days to reduce the window of exposure.
   • DKeep the 90-day change requirement but increase the minimum password length to 16 characters.
   Reveal Solution Discussion Select an answer first