A company's security policy requires that all software patches be applied within 30 days of release. However, the IT team has been inconsistent in applying patches, leading to security vulnerabilities. What should the security team create to ensure consistent patch management?

A standard that specifies the patch management software to use.

A regulation that mandates patch management.

A new policy that reiterates the 30-day patch requirement.

A procedure that outlines the steps for testing, approving, and deploying patches.

A company is expanding into a new market where a local law requires all employee personal data to be stored on servers located within that country. The company's current policy allows data to be stored in any of its global data centers. The security team must update its governance framework. Which approach best balances compliance with the law and the company's operational flexibility?

Keep the current policy and rely on encryption to protect the data.

Update the policy to require data residency for employees in that country and create a standard that defines the approved storage locations.

Ignore the law because the company is not headquartered in that country.

Create a procedure that describes how to transfer data to the new country.

A global company must comply with a new data residency law that requires personal data of citizens in a specific country to be stored within that country's borders. The company currently stores all data in a neighboring country. The security team is evaluating options. Which approach best ensures compliance while minimizing operational disruption?

Ignore the law because the company is headquartered in a different country.

Create a standard that specifies encryption algorithms and hope the law is not enforced.

Encrypt all data and store it in the current location, arguing that encryption satisfies the law.

Move all data to a data center in the required country and update the data storage policy to reflect the new location.

Which of the following is an example of a security standard?

A requirement that all passwords must be at least 12 characters and include a number

A procedure for resetting a user's password

A guideline recommending the use of multi-factor authentication

A policy stating that all data must be encrypted at rest

Certified in Cybersecurity

Domain 1Objective 5

1.5 - Understand Governance Processes CC Practice Questions (Page 3)

Part of the Security Principles domain, which accounts for 26% of the CC exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–21 in this domain), expect 3–4 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)

16questions here

4free pages

4concepts

26%of the exam

Questions 11–15

11application · medium
A company's security policy requires that all software patches be applied within 30 days of release. However, the IT team has been inconsistent in applying patches, leading to security vulnerabilities. What should the security team create to ensure consistent patch management?
Select an answer first
12expert · hard
A company is expanding into a new market where a local law requires all employee personal data to be stored on servers located within that country. The company's current policy allows data to be stored in any of its global data centers. The security team must update its governance framework. Which approach best balances compliance with the law and the company's operational flexibility?
Select an answer first
13expert · hard
A global company must comply with a new data residency law that requires personal data of citizens in a specific country to be stored within that country's borders. The company currently stores all data in a neighboring country. The security team is evaluating options. Which approach best ensures compliance while minimizing operational disruption?
Select an answer first
14foundation · easy
Which of the following is an example of a security standard?
Select an answer first
15foundation · easy
Which document provides the step-by-step instructions needed to implement a policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CC” is a trademark of its owner, used for identification only.

1.5 - Understand Governance Processes CC Practice Questions (Page 3)

Questions 11–15

A company's security policy requires that all software patches be applied within 30 days of release. However, the IT team has been inconsistent in applying patches, leading to security vulnerabilities. What should the security team create to ensure consistent patch management?

Which of the following is an example of a security standard?

Which document provides the step-by-step instructions needed to implement a policy?

Keep studying — Security Principles