Home > Articles

This chapter is from the book

This chapter is from the book

Developing Cybersecurity Programs and Policies in an AI-Driven World, 4th EditionDeveloping Cybersecurity Programs and Policies in an AI-Driven World, 4th Edition

Learn More Buy

This chapter is from the book

This chapter is from the book

Developing Cybersecurity Programs and Policies in an AI-Driven World, 4th EditionDeveloping Cybersecurity Programs and Policies in an AI-Driven World, 4th Edition

Learn More Buy

Multiple Choice Questions

1. The policy hierarchy is the relationships between which of the following?

  1. Guiding principles, regulations, laws, and procedures

  2. Guiding principles, standards, guidelines, and procedures

  3. Guiding principles, instructions, guidelines, and programs

  4. None of the above

2. Which of the following statements best describes the purpose of a standard?

  1. To state the beliefs of an organization

  2. To reflect the guiding principles

  3. To dictate mandatory requirements

  4. To make suggestions

3. Which of the following statements best describes the purpose of a guideline?

  1. To state the beliefs of an organization

  2. To reflect the guiding principles

  3. To dictate mandatory requirements

  4. To help people conform to a standard

4. Which of the following statements best describes the purpose of a baseline?

  1. To measure compliance

  2. To ensure uniformity across a similar set of devices

  3. To ensure uniformity and consistency

  4. To make suggestions

5. Simple step, hierarchical, graphic, and flowchart are examples of which of the following formats?

  1. Policy

  2. Program

  3. Procedure

  4. Standard

6. Which of the following terms best describes instructions and guidance on how to execute an initiative or how to respond to a situation, within a certain time frame, usually with defined stages and with designated resources?

  1. Plan

  2. Policy

  3. Procedure

  4. Package

7. Which of the following statements best describes a disadvantage to using the singular policy format?

  1. The policy can be short.

  2. The policy can be targeted.

  3. You may end up with too many policies to maintain.

  4. The policy can easily be updated.

8. Which of the following statements best describes a disadvantage to using the consolidated policy format?

  1. Consistent language is used throughout the document.

  2. Only one policy document must be maintained.

  3. The format must include a composite management statement.

  4. The document may end up being very long.

9. Policies, standards, guidelines, and procedures should all be in the same document.

  1. True

  2. False

  3. Only if the company is multinational

  4. Only if the documents have the same author

10. Version control is the management of changes to a document and should include which of the following elements?

  1. Version or revision number

  2. Date of authorization or date that the policy took effect

  3. Change description

  4. All of the above

11. What is an exploit?

  1. A phishing campaign

  2. A malicious program or code designed to exploit, or take advantage of, a single vulnerability or set of vulnerabilities

  3. A network or system weakness

  4. A protocol weakness

12. The name of the policy, policy number, and overview belong in which of the following sections?

  1. Introduction

  2. Policy heading

  3. Policy goals and objectives

  4. Policy statement

13. The aim or intent of a policy is stated in the ________.

  1. introduction

  2. policy heading

  3. policy goals and objectives

  4. policy statement

14. Which of the following statements is true?

  1. A security policy should include only one objective.

  2. A security policy should not include any exceptions.

  3. A security policy should not include a glossary.

  4. A security policy should not list all step-by-step measures that need to be taken.

15. The _________ contains the rules that must be followed.

  1. policy heading

  2. policy statement

  3. policy enforcement clause

  4. policy goals and objectives list

16. A policy should be considered _____.

  1. mandatory

  2. discretionary

  3. situational

  4. optional

17. Which of the following best describes policy definitions?

  1. A glossary of terms, abbreviations, and acronyms used in the document that the reader may be unfamiliar with

  2. A detailed list of the possible penalties associated with breaking rules set forth in the policy

  3. A list of all the members of the security policy creation team

  4. None of the above

18. The _________ contains the penalties that would apply if a portion of the security policy were to be ignored by an employee.

  1. policy heading

  2. policy statement

  3. policy enforcement clause

  4. policy statement of authority

19. What component of a security policy does the following phrase belong to? “Wireless networks are allowed only if they are separate and distinct from the corporate network.”

  1. Introduction

  2. Administrative notation

  3. Policy heading

  4. Policy statement

20. There may be situations in which it is not possible to comply with a policy directive. Where should the exemption or waiver process be explained?

  1. Introduction

  2. The policy statement

  3. Policy enforcement clause

  4. Policy exceptions

21. The name of the person/group (for example, executive committee) that authorized the policy should be included in the ___________________.

  1. version control table or policy statement

  2. heading or policy statement

  3. policy statement or policy exceptions

  4. version control table or policy heading

22. When you’re drafting a list of exceptions for a security policy, the language should _________________.

  1. be as specific as possible

  2. be as vague as possible

  3. reference another, dedicated document

  4. None of the above

23. If supporting documentation would be of use to the reader, it should be __________________.

  1. included in full in the policy document

  2. ignored because supporting documentation does not belong in a policy document

  3. listed in either the policy heading or administrative notation section

  4. included in a policy appendix

24. When writing a policy, standard, guideline, or procedure, you should use language that is ___________.

  1. technical

  2. clear and concise

  3. legalese

  4. complex

25. Readers prefer plain language because it __________________.

  1. helps them locate pertinent information

  2. helps them understand the information

  3. saves time

  4. All of the above

26. Which of the following is not a characteristic of plain language?

  1. Short sentences

  2. Using active voice

  3. Technical jargon

  4. Seven or fewer lines per paragraph

27. Which of the following is the best term to use when indicating a mandatory requirement?

  1. must

  2. shall

  3. should not

  4. may not

28. A company that uses the term “employees” to refer to workers who are on the company payroll should refer to them throughout their policies as _________.

  1. workforce members

  2. employees

  3. hired hands

  4. workers

29. Which of the following statements is true regarding policy definitions?

  1. They should be included and maintained in a separate document.

  2. The general rule is to include definitions for any topics except technical, legal, or regulatory language.

  3. The general rule of policy definitions is to include definitions for any instance of industry-specific, technical, legal, or regulatory language.

  4. They should be created before any policy or standards.

30. Even the best-written policy will fail if which of the following is true?

  1. The policy is too long.

  2. The policy is mandated by the government.

  3. The policy doesn’t have the support of management.

  4. All of the above.

Pearson IT Certification Promotional Mailings & Special Offers

I would like to receive exclusive offers and hear about products from Pearson IT Certification and its family of brands. I can unsubscribe at any time.