5.3 - Understand Best Practice Security Policies CC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which step is part of the change management process?

   • ADeleting the rollback plan after implementation
   • BImplementing changes directly in production without review
   • CTesting the change in a non-production environment
   • DKeeping no records of the change for audit purposes
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization is implementing a new password policy. The security team wants to ensure that passwords are resistant to brute-force attacks and that compromised passwords are not reused. Which combination of password policy components should be implemented?

   • ARequire a password change every 30 days and use a simple complexity rule like requiring one number
   • BAllow users to set any password but require multi-factor authentication for all accounts
   • CEnforce a minimum length of 14 characters and maintain a list of commonly used or breached passwords to block
   • DSet a maximum password age of 90 days and require a mix of uppercase, lowercase, numbers, and symbols
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company's acceptable use policy (AUP) prohibits employees from using corporate devices for personal activities. However, the company is considering allowing employees to use personal devices for work (BYOD). The security team is concerned about the blurring of lines between personal and professional use. What is the best way to address this concern?

   • ARequire employees to sign a separate agreement that waives their privacy rights on personal devices
   • BUpdate the AUP to clearly define acceptable use of personal devices for work and update the BYOD policy to specify security controls
   • CProhibit BYOD entirely and require employees to use only company-owned devices
   • DAllow BYOD but do not update the AUP, as the existing policy is sufficient
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which element is a key component of a data handling policy?

   • AIncident response team roles
   • BPassword complexity requirements
   • CSocial media usage guidelines
   • DData classification scheme
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is migrating to a new identity management system. The security team must enforce a password policy that balances security with user productivity. The company has a large number of remote workers who frequently forget their passwords. Which password policy approach best balances security and usability?

   • AUse a single sign-on solution and eliminate passwords entirely for all applications
   • BRequire a minimum length of 12 characters, enable multi-factor authentication, and allow users to reset forgotten passwords via self-service
   • CSet a short password expiration period and require users to use a password manager
   • DRequire a complex password with special characters and force a password change every 30 days
   Reveal Solution Discussion Select an answer first