5.3 - Understand Best Practice Security Policies CC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An e-commerce company collects customer names, addresses, and purchase history. The company wants to expand its business by sharing this data with third-party marketing partners. The legal department advises that the company must be transparent with customers about this practice. What should the company do to align with best practice privacy policies?

   • AImplement a change management process for the marketing database
   • BRequire customers to change their passwords every 90 days
   • CEncrypt all customer data in the database to prevent unauthorized access
   • DUpdate the privacy policy to clearly disclose that customer data may be shared with third-party marketing partners
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization discovers that an employee has been using the corporate email system to send personal messages with sensitive attachments. The organization wants to prevent this behavior. Which policy should be updated to explicitly address this issue?

   • AThe acceptable use policy, by adding a provision that prohibits using corporate resources for personal communications that involve sensitive data
   • BThe change management policy, by requiring approval for sending emails with attachments
   • CThe data handling policy, by specifying encryption for all email attachments
   • DThe password policy, by requiring more frequent password changes for email accounts
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company allows employees to connect personal laptops to the corporate network. The security team is concerned about malware infections on personal devices spreading to the corporate network. Which policy provision would best mitigate this risk?

   • AProhibit employees from using personal devices for any work-related activity
   • BRequire employees to sign an acceptable use policy that prohibits downloading unauthorized software
   • CRequire that personal devices have up-to-date antivirus software and a host firewall before connecting to the network
   • DProvide a separate guest network for personal devices with no access to corporate resources
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Why is data separation an important consideration in a BYOD policy?

   • ATo keep corporate data separate from personal data on the device
   • BTo ensure that only the IT department can access the device
   • CTo prevent the device from connecting to the internet
   • DTo allow employees to mix personal and corporate data freely
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is updating its security policies. The IT manager wants to reduce the risk of credential theft and unauthorized access. The company also wants to ensure that employees do not share their credentials with colleagues. Which policy update would best address both concerns?

   • AIncrease password expiration frequency to every 30 days and require a minimum length of 12 characters
   • BImplement a single sign-on solution and require employees to use a password manager
   • CRequire multi-factor authentication for all system access and include a clause in the acceptable use policy prohibiting credential sharing
   • DProvide security awareness training on phishing and require employees to change passwords annually
   Reveal Solution Discussion Select an answer first