A company has just approved a new acceptable use policy. To ensure employees understand and comply with it, management wants to communicate the policy effectively. Which approach is most likely to achieve compliance?

Posting the policy on the company intranet without further action

Sending a one-time email to all employees

Mandatory training sessions and signed acknowledgment from all employees

Including the policy in the employee handbook only

An organization's security policy requires that 'all remote access must be secured.' The network team needs to configure VPN connections. What should they reference to determine the mandatory encryption protocol and authentication method?

The security guideline for remote access

The security standard for remote access

The security policy for remote access

The security procedure for VPN setup

A security procedure for incident response is outdated and does not include steps for handling ransomware. The security team needs to update the procedure, but they are concerned about the time it will take to train all staff on the new steps. What is the most effective way to implement the updated procedure?

Update the procedure and distribute it via email without training

Update the procedure and train all staff at the next annual training

Delay the update until a full training program can be developed

Update the procedure, then conduct targeted training for incident response team members first

Certified Information Systems Security Professional

Domain 1Objective 6

1.6 - Develop, Document, and Implement Security Policy, Standards, Procedures, and Guidelines CISSP Practice Questions (Page 4)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

16%of the exam

Questions 16–20

16foundation · easy
Which document type is most likely to contain the exact steps to reset a user's password?
Select an answer first
17application · medium
A company has just approved a new acceptable use policy. To ensure employees understand and comply with it, management wants to communicate the policy effectively. Which approach is most likely to achieve compliance?
Select an answer first
18application · medium
An organization's security policy requires that 'all remote access must be secured.' The network team needs to configure VPN connections. What should they reference to determine the mandatory encryption protocol and authentication method?
Select an answer first
19expert · hard
A security procedure for incident response is outdated and does not include steps for handling ransomware. The security team needs to update the procedure, but they are concerned about the time it will take to train all staff on the new steps. What is the most effective way to implement the updated procedure?
Select an answer first
20application · medium
A financial services firm is updating its remote access security documentation. The CISO wants a document that defines the organization's position on remote access, states who is authorized, and describes the consequences of noncompliance. Which document type should the CISO approve?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

1.6 - Develop, Document, and Implement Security Policy, Standards, Procedures, and Guidelines CISSP Practice Questions (Page 4)

Questions 16–20

Which document type is most likely to contain the exact steps to reset a user's password?

A company has just approved a new acceptable use policy. To ensure employees understand and comply with it, management wants to communicate the policy effectively. Which approach is most likely to achieve compliance?

An organization's security policy requires that 'all remote access must be secured.' The network team needs to configure VPN connections. What should they reference to determine the mandatory encryption protocol and authentication method?

A financial services firm is updating its remote access security documentation. The CISO wants a document that defines the organization's position on remote access, states who is authorized, and describes the consequences of noncompliance. Which document type should the CISO approve?

Keep studying — Security and Risk Management