Policy Management GSTRT Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   Why is it important to have a formal process for maintaining security policies?

   • ATo satisfy auditors without further action
   • BTo reduce the need for employee training
   • CTo eliminate all security risks
   • DTo ensure policies remain current and effective
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which input is most relevant to a continuous improvement cycle for security policies?

   • AMarketing campaign results
   • BLessons learned from security incidents
   • CHardware vendor pricing
   • DEmployee vacation schedules
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A retail company's data-classification policy was recently updated to include a new category for customer payment data. The IT operations team has a procedure for granting database access that does not reference the new category. What is the most appropriate action?

   • AUpdate the database-access procedure to reference the new data-classification category and define access requirements for it.
   • BLeave the procedure unchanged because it already covers all database access.
   • CRevise the data-classification policy to remove the new category because the procedure was not updated.
   • DCreate a separate policy for customer payment data access and leave the existing procedure unchanged.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary goal of a continuous improvement cycle for security policies?

   • ATo minimize the number of policies
   • BTo ensure policies never change
   • CTo automate all policy enforcement
   • DTo adapt policies to changing threats and feedback
   Reveal Solution Discussion Select an answer first