Analysis of Security Policies and Procedures CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which activity is most likely to reveal a gap between a security procedure and its actual implementation?

   • AReviewing the procedure document for spelling errors
   • BComparing the procedure to industry best practices
   • CObserving staff performing the procedure in a live environment
   • DChecking the procedure's version number
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of formulating recommendations after analyzing security policies and procedures?

   • ATo replace the need for future analyses
   • BTo propose improvements that address identified weaknesses and gaps
   • CTo assign blame for security failures
   • DTo document the analysis process for auditors
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A recent risk assessment identified that the company's remote access solution uses an outdated VPN protocol with known vulnerabilities. The security policy, however, only states that 'remote access must be provided to employees.' The tester is asked to analyze the policy in light of the risk assessment. What is the most appropriate action?

   • AUpdate the risk assessment to reflect that the policy is compliant.
   • BConclude that the policy is adequate because it allows remote access, and the risk is an implementation issue.
   • CRecommend disabling remote access entirely to eliminate the risk.
   • DRecommend updating the policy to require the use of a secure remote access solution, such as a modern VPN protocol or zero-trust network access.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security tester is evaluating the incident response procedure. The policy states that 'security incidents must be reported to the CISO within one hour of detection.' The procedure, however, instructs help desk staff to first verify the incident and then escalate, which typically takes two to three hours. What is the most appropriate finding?

   • AThe help desk should be bypassed entirely to speed up reporting.
   • BThe procedure is more thorough and should be kept as is.
   • CThe policy's one-hour requirement is unrealistic and should be changed to three hours.
   • DThe procedure is inconsistent with the policy, and the tester should recommend aligning the procedure to meet the one-hour requirement.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A risk assessment found that the company's third-party vendors have access to sensitive data without regular security reviews. The security policy states that 'third-party access must be managed.' The tester is asked to analyze the policy in light of the risk assessment. What is the most appropriate recommendation?

   • AConclude that the policy is adequate because it mentions managing third-party access.
   • BUpdate the policy to require periodic security assessments of third-party vendors and align the procedure accordingly.
   • CSuggest that the risk assessment be revised to exclude third-party access risks.
   • DRecommend terminating all third-party relationships to eliminate the risk.
   Reveal Solution Discussion Select an answer first