Define and Develop Security Documentation CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization is standardizing its security documentation library. The CISO has approved a high-level policy on data classification. The security team now needs to create a document that specifies the mandatory technical controls (e.g., encryption algorithms, key lengths, access control rules) that must be applied to each data classification level. According to the standard documentation hierarchy, which type of document should this be?

   • AA security plan that outlines the timeline for rolling out the data classification program
   • BA security guideline that suggests optional approaches for protecting classified data
   • CA security procedure that lists the exact commands to configure encryption on each server
   • DA security standard that defines mandatory, measurable requirements for implementing the policy
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which stakeholder group is primarily responsible for contributing technical details to security documentation, such as specific threat models and code-level mitigations?

   • AExternal auditors only
   • BMarketing team
   • CHuman resources
   • DDevelopers and security engineers
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary goal of security documentation distribution?

   • ATo print and mail documents to all employees
   • BTo publish documents on the public internet
   • CTo ensure relevant stakeholders have access to the documents they need
   • DTo restrict access to all documents to only the security team
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is writing a new security standard for cloud resource configuration. The analyst has included sections for scope, roles, and responsibilities. However, the standard lacks a clear definition of what constitutes a violation and the consequences for non-compliance. According to standard documentation structure, which section is missing that is critical for enforceability?

   • ACompliance and enforcement, which specifies how violations are detected and the consequences for non-compliance
   • BA glossary of cloud computing terms
   • CA list of the software tools used to manage the cloud environment
   • DThe names of the cloud service providers the organization uses
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which type of security document defines mandatory requirements that must be followed, such as 'all passwords must be at least 12 characters'?

   • AGuideline
   • BPolicy
   • CStandard
   • DProcedure
   Reveal Solution Discussion Select an answer first