What is the primary purpose of a security policy within an organization?

To provide high-level direction and management expectations for security

To specify exact technical configurations for every system

To outline step-by-step instructions for daily tasks

To offer optional recommendations for improving security

A security policy has been updated to reflect new regulatory requirements. The security manager needs to ensure that all employees are aware of the changes. What is the most important step in this process?

Archiving the old version of the policy

Updating the version number in the document control system

Communicating the changes and obtaining acknowledgment from employees

Why should security policies be reviewed periodically?

To ensure they remain current with changes in the organization and threat landscape

To reduce the frequency of employee training

To comply with a one-time legal requirement

To simplify the policies by removing all technical details

Certified Information Systems Security Professional

Domain 1Objective 6

1.6 - Develop, Document, and Implement Security Policy, Standards, Procedures, and Guidelines CISSP Practice Questions (Page 3)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

16%of the exam

Questions 11–15

11application · medium
A company's security policy states that 'all data at rest must be encrypted.' The security team needs to implement this policy consistently across all servers. What should they create to specify the exact encryption algorithms and key lengths that must be used?
Select an answer first
12foundation · easy
Which element is typically included in a security policy document to define its applicability?
Select an answer first
13foundation · easy
What is the primary purpose of a security policy within an organization?
Select an answer first
14application · medium
A security policy has been updated to reflect new regulatory requirements. The security manager needs to ensure that all employees are aware of the changes. What is the most important step in this process?
Select an answer first
15foundation · easy
Why should security policies be reviewed periodically?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

1.6 - Develop, Document, and Implement Security Policy, Standards, Procedures, and Guidelines CISSP Practice Questions (Page 3)

Questions 11–15

A company's security policy states that 'all data at rest must be encrypted.' The security team needs to implement this policy consistently across all servers. What should they create to specify the exact encryption algorithms and key lengths that must be used?

Which element is typically included in a security policy document to define its applicability?

What is the primary purpose of a security policy within an organization?

A security policy has been updated to reflect new regulatory requirements. The security manager needs to ensure that all employees are aware of the changes. What is the most important step in this process?

Why should security policies be reviewed periodically?

Keep studying — Security and Risk Management