Understanding Security Policies and Procedures CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   A security tester is preparing to test the organization's incident response capability. They need to understand the rules for when an incident should be escalated to senior management. Which document should they consult?

   • AThe incident response procedure
   • BThe network security policy
   • CThe access control policy
   • DThe incident response policy
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common type of security policy?

   • APassword policy
   • BNetwork topology policy
   • CFirewall configuration policy
   • DEncryption algorithm policy
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security tester discovers that a colleague is bypassing the mandatory security awareness training. The organization's security policy states that all employees must complete the training annually. The tester is unsure whether to report the colleague. What is the most appropriate action for the tester?

   • AIgnore it because it is not the tester's responsibility.
   • BReport the colleague to the appropriate authority, such as the security manager.
   • CComplete the training on behalf of the colleague.
   • DConfront the colleague directly and demand they complete the training.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security tester is about to conduct a penetration test on a production system. According to the organization's security policy, all testing activities must be authorized in writing before they begin. The tester has received verbal approval from the IT manager but has not yet received the written authorization. What should the tester do?

   • AProceed with the test but only on non-production systems.
   • BDelay the test until written authorization is obtained.
   • CAsk the IT manager to confirm the verbal approval in an email.
   • DProceed with the test because verbal approval is sufficient.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How do security policies and security procedures relate to each other?

   • APolicies and procedures are interchangeable terms for the same document
   • BPolicies are optional guidelines, while procedures are mandatory requirements
   • CPolicies state what must be done, and procedures describe how to do it
   • DProcedures define the high-level rules, and policies provide the detailed steps to implement them
   Reveal Solution Discussion Select an answer first