1.4 Define and Maintain Security Policy Framework ISSMP Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   An e-commerce company collects customer data, including payment card information and browsing history. The company must comply with PCI DSS and GDPR. You need to ensure that the data classification scheme reflects the different protection requirements for these data types. What should you do?

   • AClassify payment card information as confidential and browsing history as internal, with appropriate controls for each.
   • BClassify all customer data as highly sensitive and apply the same protection controls to all of it.
   • CClassify browsing history as public since it is not as sensitive as payment card information.
   • DUse a single classification level for all data to simplify compliance.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which document provides step-by-step instructions for performing a specific security task, such as configuring a firewall?

   • AProcedure
   • BBaseline
   • CPolicy
   • DGuideline
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   A security manager is proposing a new policy that requires multi-factor authentication for all remote access. Several senior managers are resistant because they believe it will hinder productivity. What is the best way to gain their support?

   • AOffer to exempt senior managers from the policy to avoid conflict.
   • BExplain that the policy is required by an external standard and cannot be changed.
   • CImplement the policy immediately and deal with complaints later.
   • DDemonstrate how the policy reduces the risk of credential theft and protects company data.
   Reveal Solution Discussion Select an answer first