Understanding Security Policies and Procedures CT-SEC Practice Questions (Page 6)

Questions 26–28

1. 26expert · hard

   A security tester is planning a penetration test that includes social engineering. The organization's security policy requires that all testing be authorized in writing, but also states that testing must not violate employee privacy. The tester has written authorization, but the social engineering test involves collecting personal information about employees from public sources. The tester is concerned about the privacy policy. What is the best course of action?

   • AReview the privacy policy and adjust the test plan to avoid using personal information without consent.
   • BProceed with the test but only use information that is already known to the security team.
   • CCancel the social engineering test because it inherently violates privacy.
   • DProceed with the test because the written authorization covers all testing activities.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security tester is reviewing a new security policy that states: 'All remote access must be encrypted.' The tester notices that the policy does not specify which encryption protocols are acceptable. What is the best action for the tester?

   • AIgnore the policy because it is too vague to be useful.
   • BAssume that any encryption is acceptable and proceed.
   • CRecommend that the organization develop a procedure that specifies acceptable encryption protocols.
   • DRewrite the policy to include specific encryption protocols.
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   A security tester is preparing to run a vulnerability scan. The organization's security policy requires that all scans be performed from a specific, approved scanning workstation. The tester's laptop is not the approved workstation. What should the tester do?

   • AUse the laptop because it has the same scanning tools installed.
   • BUse the approved scanning workstation as required by the policy.
   • CRun the scan from the laptop but document the deviation.
   • DAsk a colleague to run the scan on the approved workstation while the tester watches.
   Reveal Solution Discussion Select an answer first