1.4 Define and Maintain Security Policy Framework ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial institution has a security policy that requires encryption of all sensitive data at rest. However, employees are unsure how to implement this requirement in their daily work. What should you develop to help employees comply with the policy?

   • AA guideline that suggests best practices for encryption without mandatory steps.
   • BA baseline that defines the minimum encryption standard for all data.
   • CA procedure document that outlines step-by-step instructions for encrypting data.
   • DA new security policy that provides more detailed encryption requirements.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A multinational financial services company is expanding into a new country that has strict data localization laws. The company's existing security policy framework was developed for its home country and does not address cross-border data transfers. As the security manager, you need to update the framework to ensure compliance while maintaining operational efficiency. What should you do first?

   • ADraft a new data protection policy that mandates all data be stored and processed within the new country's borders.
   • BImmediately implement technical controls to prevent any data from leaving the new country's jurisdiction.
   • CConsult with legal counsel to determine if the company can apply for an exemption from the data localization law.
   • DConduct a gap analysis comparing current policies against the new country's data localization requirements.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A healthcare organization is updating its security policy framework to align with new regulatory requirements. The organization handles patient records, research data, and general administrative data. You need to ensure that the classification scheme and corresponding protection requirements are clearly defined. What should you do?

   • AFocus only on patient records and ignore other data types since they are less sensitive.
   • BCreate a single classification level for all data to simplify compliance and reduce administrative overhead.
   • CDefine classification levels based on sensitivity and regulatory obligations, and specify protection requirements for each level.
   • DAdopt the classification scheme from a similar organization without modification to save time.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A government agency has a security policy that requires all laptops to be encrypted. The agency has issued a standard for encryption algorithms, but employees are using different tools to encrypt their laptops, leading to inconsistencies. What should you develop to ensure consistent implementation?

   • AA procedure that describes how to encrypt a laptop using any tool.
   • BA new policy that reiterates the encryption requirement.
   • CA guideline that recommends specific encryption tools.
   • DA baseline that specifies the minimum encryption standard and approved tools.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security manager is updating the organization's remote work policy. The update includes stricter access controls and mandatory VPN usage. Several employees have expressed concerns about the impact on their work-life balance. What should the security manager do to address these concerns and gain support?

   • AImplement the policy immediately without discussion to avoid delays.
   • BAsk employees to submit formal complaints to management.
   • CRevise the policy to remove the stricter controls to keep employees happy.
   • DExplain the security benefits of the updated policy and provide training to help employees adapt.
   Reveal Solution Discussion Select an answer first