Which provision is commonly found in an acceptable use policy?

Steps for approving a network firewall change

Requirement to change passwords every 90 days

Procedure for disposing of hard drives

Prohibition of using company resources for illegal activities

A company is implementing a new password policy that requires multi-factor authentication (MFA). The IT department is concerned about the impact on help desk call volume due to users having trouble with MFA. Which approach best addresses the security benefit of MFA while minimizing user friction?

Implement MFA but allow users to opt out if they find it inconvenient

Roll out MFA in phases, starting with high-risk users, and provide training and self-service enrollment

Skip MFA and rely on strong passwords alone

Implement MFA for all users at once and require them to contact the help desk for any issues

A company is decommissioning an old server that contains sensitive customer data. The server is no longer needed, but the data must be retained for legal purposes. The company wants to ensure that the data is not accessible from the decommissioned server. What is the best approach?

Delete the data from the server and dispose of the server without any further action

Keep the server in a locked room and do not change its configuration

Migrate the data to a secure archival storage system and then securely erase the server's storage

Encrypt the data on the server and leave the server in place

A consulting firm allows employees to use personal tablets for client work. The firm needs to ensure that client data is not stored on the personal device after the project ends. Which BYOD control is most effective for this requirement?

Use a containerization solution that separates corporate data and allows it to be remotely wiped without affecting personal data

Encrypt the entire tablet and require a strong password

Require employees to manually delete client files from their device at the end of the project

Prohibit the use of personal tablets for client work and provide company-owned devices

A company is implementing a BYOD policy. The security team wants to ensure that corporate data on personal devices is protected, but employees are concerned about privacy. Which approach best balances corporate security with employee privacy?

Prohibit employees from using personal devices for work and provide company-owned devices

Require employees to install a security agent that monitors all device activity, including personal apps

Require employees to allow the company to remotely wipe the entire device if it is lost or stolen

Use a mobile device management (MDM) solution that creates a separate, encrypted container for corporate data and allows remote wipe of only that container

Certified in Cybersecurity

Domain 5Objective 3

5.3 - Understand Best Practice Security Policies CC Practice Questions (Page 4)

Part of the Security Operations domain, which accounts for 18% of the CC exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 2–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

18%of the exam

Questions 16–20

16foundation · easy
Which provision is commonly found in an acceptable use policy?
Select an answer first
17expert · hard
A company is implementing a new password policy that requires multi-factor authentication (MFA). The IT department is concerned about the impact on help desk call volume due to users having trouble with MFA. Which approach best addresses the security benefit of MFA while minimizing user friction?
Select an answer first
18expert · hard
A company is decommissioning an old server that contains sensitive customer data. The server is no longer needed, but the data must be retained for legal purposes. The company wants to ensure that the data is not accessible from the decommissioned server. What is the best approach?
Select an answer first
19application · medium
A consulting firm allows employees to use personal tablets for client work. The firm needs to ensure that client data is not stored on the personal device after the project ends. Which BYOD control is most effective for this requirement?
Select an answer first
20expert · hard
A company is implementing a BYOD policy. The security team wants to ensure that corporate data on personal devices is protected, but employees are concerned about privacy. Which approach best balances corporate security with employee privacy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CC” is a trademark of its owner, used for identification only.