Analysis of Security Policies and Procedures CT-SEC Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security tester is analyzing the security policy of a startup that has grown rapidly. The policy was written when the company had 10 employees and states that 'all employees have access to all systems.' The company now has 200 employees, and the tester finds that many employees have access to systems they do not need. What is the most appropriate recommendation?

   • ARecommend that employees self-report the systems they need.
   • BSuggest that the company hire more IT staff to monitor access.
   • CKeep the policy as is because it has worked so far.
   • DUpdate the policy to implement a least-privilege access model and conduct a review of current access rights.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security tester is reviewing the account management procedure. The policy requires that user accounts be disabled within 24 hours of an employee's departure. The procedure relies on the HR system to notify IT, but the tester finds that HR notifications are often delayed by up to a week. The tester must recommend a solution that addresses the gap without overburdening IT. What is the most appropriate recommendation?

   • ADisable all accounts at the end of each month to align with HR reporting.
   • BChange the policy to allow a 7-day window for account disablement.
   • CIntegrate the HR and IT systems so that account disablement is automated upon termination.
   • DRequire IT to manually check the HR system daily for terminations.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security tester is analyzing the password policy of a company. The policy states that 'passwords must be strong and changed regularly.' The tester finds that the actual password requirements are only 6 characters and passwords never expire. What is the most appropriate finding?

   • AThe tester should recommend that passwords never expire to reduce user frustration.
   • BThe policy is too vague to be enforceable, and the implementation does not meet industry best practices.
   • CThe implementation is correct because 6 characters is a common minimum.
   • DThe policy is adequate because it says passwords must be strong.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When analyzing a security policy, what is the primary purpose of identifying its scope?

   • ATo list the specific technical controls that must be implemented
   • BTo determine which systems, users, and data are covered by the policy
   • CTo identify the owner of the policy document
   • DTo document the penalties for non-compliance
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A multinational company is reviewing its data classification policy. The policy currently classifies all data as 'internal' and does not differentiate between public, confidential, and restricted data. The company must comply with GDPR for EU customer data and with local data protection laws in other countries. The tester is asked to recommend improvements. What is the most appropriate recommendation?

   • AKeep the single classification level to simplify compliance.
   • BImplement a data classification scheme with multiple levels and map each level to specific handling and compliance requirements.
   • CAdopt the highest regulatory standard for all data, regardless of classification.
   • DClassify all data as 'restricted' to ensure maximum protection.
   Reveal Solution Discussion Select an answer first