5.3 - Understand Best Practice Security Policies CC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company's change management policy requires that all changes be approved by a change advisory board (CAB). A critical vulnerability is discovered in a production system, and the security team wants to apply a patch immediately. The CAB is not scheduled to meet for another week. What is the best course of action?

   • AAsk the system administrator to apply the patch and inform the CAB after the fact, but do not document it
   • BApply the patch without any documentation or approval to save time
   • CApply the patch immediately and document it as an emergency change, with CAB approval obtained retrospectively
   • DWait for the next CAB meeting to approve the change, even if it means the system remains vulnerable
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary scope of an acceptable use policy (AUP)?

   • AListing the hardware specifications for new computers
   • BDefining permitted and prohibited uses of organizational IT resources
   • CDescribing how to classify data according to sensitivity
   • DSpecifying the technical steps for patching servers
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A healthcare organization stores patient records in a cloud storage service. The compliance team requires that patient data be encrypted both at rest and in transit, and that access to the data be logged. The organization also needs to inform patients about how their data is used. Which combination of policy elements should the organization implement to meet these requirements?

   • AAn acceptable use policy that prohibits employees from sharing patient data on personal devices
   • BA password policy that mandates complex passwords and multi-factor authentication for all cloud storage users
   • CA data handling policy that specifies encryption standards for storage and transmission, and a privacy policy that discloses data collection and usage practices
   • DA change management policy that requires approval before any modifications to the cloud storage configuration
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of a change management policy?

   • ATo define the rules for using personal devices at work
   • BTo ensure changes to IT systems are documented, tested, and approved before implementation
   • CTo specify how data should be classified and labeled
   • DTo outline the steps for responding to a malware outbreak
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a key security control in a BYOD policy?

   • ARequiring employees to purchase devices from a specific vendor
   • BAllowing employees to use any device without restrictions
   • CRequiring device registration before accessing corporate resources
   • DProhibiting all personal devices from connecting to the internet
   Reveal Solution Discussion Select an answer first