A mobile app developer collects user location data to provide personalized services. The developer wants to ensure compliance with privacy regulations and build user trust. Which practice should the developer adopt?

Encrypt all location data stored on the device and in the cloud

Require users to create a strong password and enable multi-factor authentication

Store location data on the device only and never transmit it to a server

Provide a clear and concise privacy policy within the app that explains what data is collected and how it is used

Which component is typically included in a strong password policy?

Minimum password length and complexity requirements

A requirement to share passwords with the IT help desk

A policy that all users use the same password for simplicity

A rule that passwords must never be changed

A software company uses a change management process for its production environment. A developer needs to deploy a critical security patch immediately. The change management policy requires all changes to be tested and approved. What is the best course of action?

Skip the change management process and deploy the patch directly to production

Deploy the patch immediately and document the change after the fact as an emergency change

Follow the standard change management process, including testing and approval, even if it delays the patch

Ask the developer to test the patch in a non-production environment and then deploy it without approval

A financial institution is planning to upgrade its core banking application. The change will affect customer data processing and requires a brief downtime. The compliance team requires that the change be reversible and that all steps be documented. What is the most important element to include in the change management plan?

A detailed rollback procedure that specifies how to restore the previous version of the application

A list of all employees who have access to the production environment

A communication plan to inform customers about the scheduled downtime

A data handling policy that defines how customer data is classified during the upgrade

What is the primary purpose of a data handling policy?

To define how data should be classified, stored, transmitted, and disposed of to protect its confidentiality, integrity, and availability

To list the software applications approved for use within the organization

To specify the technical configuration of firewalls and intrusion detection systems

To outline the steps for responding to a security incident

Certified in Cybersecurity

Domain 5Objective 3

5.3 - Understand Best Practice Security Policies CC Practice Questions (Page 1)

Part of the Security Operations domain, which accounts for 18% of the CC exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

18%of the exam

Questions 1–5

1application · medium
A mobile app developer collects user location data to provide personalized services. The developer wants to ensure compliance with privacy regulations and build user trust. Which practice should the developer adopt?
Select an answer first
2foundation · easy
Which component is typically included in a strong password policy?
Select an answer first
3application · medium
A software company uses a change management process for its production environment. A developer needs to deploy a critical security patch immediately. The change management policy requires all changes to be tested and approved. What is the best course of action?
Select an answer first
4application · medium
A financial institution is planning to upgrade its core banking application. The change will affect customer data processing and requires a brief downtime. The compliance team requires that the change be reversible and that all steps be documented. What is the most important element to include in the change management plan?
Select an answer first
5foundation · easy
What is the primary purpose of a data handling policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CC” is a trademark of its owner, used for identification only.