What is the primary purpose of security procedures?

To define the overall security objectives of the organization

To specify mandatory technical requirements for systems

To offer recommended practices that are not mandatory

To provide step-by-step instructions for implementing policies and standards

An organization's security policy mandates the use of complex passwords, but it does not specify a minimum length. The security team wants to recommend that users create passphrases of at least 15 characters to improve security, without making it a mandatory requirement. What should they publish?

A revision to the security policy

How do security standards differ from security policies?

Standards are written by external bodies, while policies are internal

Standards are optional, while policies are mandatory

Standards are mandatory and specific, while policies are high-level and directional

Standards are step-by-step instructions, while policies are general statements

What is the correct order of documents from highest to lowest in a security documentation hierarchy?

Guideline, standard, policy, procedure

Standard, policy, procedure, guideline

Policy, standard, procedure, guideline

Procedure, standard, policy, guideline

A security architect is designing a documentation framework for a new subsidiary. The subsidiary has its own legal requirements, but the parent company has global policies. The architect wants to ensure consistency while allowing for local variations. What is the best approach?

Use the parent company's policies and standards without any local adaptation

Create local policies that override the parent company's policies

Create entirely separate policies for the subsidiary

Adopt the parent company's policies and create local standards and procedures that address subsidiary-specific requirements

Certified Information Systems Security Professional

Domain 1Objective 6

1.6 - Develop, Document, and Implement Security Policy, Standards, Procedures, and Guidelines CISSP Practice Questions (Page 6)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

16%of the exam

Questions 26–30

26foundation · easy
What is the primary purpose of security procedures?
Select an answer first
27application · easy
An organization's security policy mandates the use of complex passwords, but it does not specify a minimum length. The security team wants to recommend that users create passphrases of at least 15 characters to improve security, without making it a mandatory requirement. What should they publish?
Select an answer first
28foundation · easy
How do security standards differ from security policies?
Select an answer first
29foundation · easy
What is the correct order of documents from highest to lowest in a security documentation hierarchy?
Select an answer first
30expert · hard
A security architect is designing a documentation framework for a new subsidiary. The subsidiary has its own legal requirements, but the parent company has global policies. The architect wants to ensure consistency while allowing for local variations. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.