Analysis of Security Policies and Procedures CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's security policy requires that all employees complete security awareness training annually. The procedure states that training is assigned via the HR system. During a review, the tester finds that employees in the sales department have not received training assignments for two years because the HR system does not include a field for sales roles. What is the most appropriate recommendation?

   • AUpdate the HR system to include all employee roles and ensure the training assignment procedure covers every department.
   • BChange the policy to require training only for employees who handle sensitive data.
   • CManually track training for the sales department using a spreadsheet.
   • DExempt the sales department from the training requirement because they do not handle sensitive data.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which characteristic makes a recommendation for improving a security policy most useful?

   • AIt is specific and actionable, with a clear owner and timeline
   • BIt is identical to recommendations from other organizations
   • CIt focuses only on technical controls
   • DIt is vague enough to allow flexibility in implementation
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security tester is evaluating the data deletion procedure of a cloud service provider. The policy states that 'customer data must be deleted upon request.' The procedure, however, only deletes data from the primary storage, leaving backups intact for 30 days. The provider is subject to GDPR, which requires erasure of personal data upon request. What is the most appropriate recommendation?

   • AKeep the current procedure because backups are not considered personal data.
   • BRecommend that customers be required to waive their deletion rights for backups.
   • CChange the policy to state that data is deleted within 30 days to match the backup retention.
   • DUpdate the procedure to ensure that data is also deleted from backups, or inform the customer of the backup retention period.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A risk assessment revealed that the company's backup procedure only retains backups for 7 days, but the business continuity plan requires a 30-day retention to meet recovery objectives. The security policy does not specify backup retention. What should the tester recommend?

   • AUpdate the security policy to include a backup retention requirement of at least 30 days, and align the procedure accordingly.
   • BKeep the procedure as is because the policy does not specify a retention period.
   • CRecommend reducing the business continuity requirement to 7 days to match the current procedure.
   • DSuggest that the backup procedure be outsourced to a cloud provider to improve retention.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company's security policy requires that all network traffic be encrypted. The tester observes that the procedure for configuring network devices does not include encryption settings for legacy devices that do not support modern encryption. What is the most appropriate finding?

   • AThe procedure is incomplete because it does not address how to handle legacy devices, creating a gap between policy and implementation.
   • BThe tester should recommend replacing all legacy devices immediately.
   • CThe policy should be changed to allow unencrypted traffic on legacy devices.
   • DThe legacy devices should be exempt from the policy because they are old.
   Reveal Solution Discussion Select an answer first