Analysis of Security Policies and Procedures CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of a regulatory compliance review of security policies?

   • ATo make the policies more complex to deter attackers
   • BTo reduce the number of security policies
   • CTo replace the organization's security policies with industry standards
   • DTo ensure that the policies meet the requirements of applicable laws and regulations
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When evaluating security procedures, what does 'consistency with policies' mean?

   • AThe procedure is the same across all departments
   • BThe procedure's steps align with the requirements and intent of the related security policy
   • CThe procedure uses the same tools as other procedures
   • DThe procedure is reviewed annually
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company operating in the European Union is reviewing its data protection policy. The policy states that 'personal data may be transferred to any country for business purposes.' The tester is asked to evaluate this policy for regulatory compliance. What is the most appropriate recommendation?

   • AKeep the policy as is because GDPR only applies to data stored within the EU.
   • BRecommend that the company store all data on-premises to avoid GDPR compliance.
   • CAdvise the company to obtain consent from each data subject before any transfer.
   • DUpdate the policy to require that international data transfers comply with GDPR transfer mechanisms, such as adequacy decisions or standard contractual clauses.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security tester is analyzing the patch management policy and procedure. The policy requires that critical patches be applied within 48 hours. The procedure, however, requires a full regression test before deployment, which typically takes 5 days. The tester must recommend a solution that balances security and operational stability. What is the most appropriate recommendation?

   • AApply critical patches immediately without testing to meet the 48-hour requirement.
   • BImplement a risk-based approach: apply critical patches to a pilot group within 48 hours, then roll out to the rest after a shortened validation.
   • CChange the policy to allow 5 days for critical patches to accommodate the testing procedure.
   • DSkip the regression test for all patches to speed up deployment.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security tester is reviewing the access control policy of a mid-sized company. The policy states that 'access rights must be reviewed quarterly.' However, the tester observes that the actual review process is triggered only when a manager requests it, and the last recorded review was eight months ago. What is the most appropriate finding to report?

   • AThe procedure is inconsistent with the policy, creating a gap between the documented requirement and actual implementation.
   • BThe policy is too vague to be implemented effectively.
   • CThe access review process is effective because it is manager-driven.
   • DThe policy should be updated to reflect the actual review frequency.
   Reveal Solution Discussion Select an answer first