Define and Develop Security Documentation CSSLP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A small software company has no formal security documentation. The new CISO wants to create a set of policies, standards, and procedures quickly. To ensure consistency and completeness across all documents, and to reduce the effort of creating them from scratch, what is the most effective approach?

   • AAdopt an industry-recognized framework (e.g., NIST, ISO 27001) and use its templates and structure as the basis for the documentation set
   • BAsk each department head to write their own documents independently using their preferred format
   • CCreate a single comprehensive document that combines all policies, standards, and procedures into one file
   • DCopy the documentation set from a competitor's public website and rebrand it
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary difference between a security policy and a security procedure?

   • AA policy is optional, while a procedure is mandatory
   • BA policy states high-level intent and direction, while a procedure provides step-by-step instructions for a specific task
   • CA policy is created by developers, while a procedure is created by management
   • DA policy is technical, while a procedure is managerial
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In a security standard, which section would specify the technical implementation details, such as encryption algorithms and key lengths?

   • AControls
   • BScope
   • CPurpose
   • DRoles and responsibilities
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A software development team is preparing for a third-party security audit of their new customer-facing web application. The audit will assess whether the organization has formalized its security decision-making process. The team has informal email threads documenting security choices, but no consolidated document. The compliance officer needs a single authoritative artifact that auditors can review to understand the organization's security goals and management commitment. Which document should the team prioritize creating?

   • AA security guideline recommending optional best practices for developers to follow
   • BA detailed security procedure that provides step-by-step instructions for configuring the web server
   • CA security policy that states the organization's security objectives and management expectations
   • DA project-specific security plan that outlines the testing schedule for the current release
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security administrator updated the firewall change management procedure to reflect a new approval workflow. The administrator saved the changes to the same file, overwriting the previous version, and did not record what was changed or why. Which critical aspect of documentation management did the administrator fail to perform?

   • AInitial drafting of the document content
   • BRetirement of the old procedure
   • CDistribution of the document to the firewall team
   • DVersion control and change tracking to maintain document integrity and auditability
   Reveal Solution Discussion Select an answer first