Understanding Security Policies and Procedures CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21application · easy

   A security tester is asked to explain to a new team member why the organization has a security policy that mandates regular security testing. Which statement best describes the role of this policy?

   • AIt is optional guidance that teams can choose to follow.
   • BIt replaces the need for any other security documentation.
   • CIt establishes the high-level requirement that security testing must be performed regularly.
   • DIt provides a detailed checklist for performing each security test.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security tester is conducting a test that requires accessing sensitive customer data. The organization's security policy requires that all access to sensitive data be logged and monitored. The tester's test plan does not include logging. What should the tester do?

   • ASkip the test because logging is too complex to implement.
   • BProceed with the test because the tester has authorization to access the data.
   • CModify the test plan to include logging of all access to sensitive data.
   • DAccess the data without logging but document the decision in the test report.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security tester is conducting a social engineering test. The organization's security policy prohibits using personal information of employees without their consent. The tester finds publicly available information about an employee and considers using it in the test. What should the tester do?

   • ARefrain from using the information and seek an alternative approach that complies with the policy.
   • BUse the information because it is publicly available.
   • CAsk the employee for permission after the test is completed.
   • DUse the information but only if it is necessary for the test.
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   A security tester is asked to verify that only authorized personnel can access the server room. Which type of security policy is most relevant to this task?

   • APassword policy
   • BAccess control policy
   • CNetwork security policy
   • DIncident response policy
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security tester is updating the organization's documentation. They find that the current 'Security Policy' document contains both high-level rules and detailed step-by-step instructions. The tester wants to improve the documentation. What should they recommend?

   • ASplit the document into a separate policy document and a separate procedures document.
   • BRename the document to 'Policy and Procedures' but keep the content together.
   • CRemove the step-by-step instructions because they are not needed.
   • DKeep the document as is because it is comprehensive.
   Reveal Solution Discussion Select an answer first