Know How to Define Effective Policies, Controls and Guidelines (2.5.2, 2.5.2.1-3) ITIL-4-STRATEGIC-LEADER-MODULES Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A software development company wants to encourage its engineers to adopt secure coding practices without slowing down development. The security team is drafting a document to guide engineers in making decisions about code security. What should the document be?

   • AA policy that mandates specific security tools for every project.
   • BA control that automatically blocks code that does not meet security standards.
   • CA guideline that provides recommended practices and examples for secure coding.
   • DA procedure that outlines step-by-step instructions for every coding task.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A marketing department is creating guidelines for social media posts. The guidelines should allow creativity while ensuring brand consistency. The team is debating how detailed the guidelines should be. What should they do?

   • ACreate guidelines that are identical to the organization's social media policy.
   • BCreate no guidelines and let each marketer decide independently.
   • CCreate very detailed guidelines that specify exact wording for every post.
   • DCreate guidelines that provide principles, examples, and boundaries, allowing for creative interpretation.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A technology company is developing a policy for the use of artificial intelligence in its products. The policy must be clear enough to guide developers, relevant to current AI capabilities, and aligned with the company's ethical principles. The policy team is facing conflicting opinions from legal, engineering, and ethics stakeholders. What should the team do to create an effective policy?

   • AFacilitate a structured dialogue among stakeholders to reconcile conflicting views and build consensus.
   • BPrioritize the legal perspective to ensure compliance and avoid regulatory risk.
   • CAdopt an industry-standard AI policy without modification.
   • DWrite a high-level policy that avoids specific details to prevent conflicts.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A non-profit organization is developing a governance framework for its volunteer programs. The board wants to ensure that volunteers understand the organization's expectations, have guidance for handling unexpected situations, and that the organization can monitor volunteer performance. What should the framework include?

   • AA single document that combines all expectations, guidance, and monitoring procedures.
   • BA policy that is detailed enough to cover all possible situations.
   • CA policy that defines expectations, guidelines for handling situations, and controls to monitor performance.
   • DGuidelines that are enforced as strict rules.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An e-commerce company wants to reduce fraudulent transactions without negatively affecting the customer experience. The fraud team proposes a control that requires additional verification for all transactions above $100. The customer experience team is concerned that this will frustrate customers. What should the organization do to define an effective control?

   • ASet the threshold at $500 to reduce customer impact.
   • BRemove the control and rely on post-transaction fraud detection.
   • CImplement the control for all transactions above $100 to reduce fraud.
   • DUse a risk-scoring model to apply additional verification only to transactions that are identified as high-risk.
   Reveal Solution Discussion Select an answer first