Security Policies

1. An employee is caught running a cryptocurrency mining operation on company servers. The company claims the activity violated organizational policy. For this claim to be legally defensible and limit the company's liability for the employee's use of its systems, what policy document must the employee have previously acknowledged?

A. Disaster recovery plan — which covers unauthorized use of organizational systems B. Acceptable use policy (AUP) — which defines permitted and prohibited uses of organizational systems and must be acknowledged by employees to establish documented notice C. Business continuity plan — which requires employees to use systems only for business continuity purposes D. Information security policy — which only applies to IT staff managing security controls

2. An organization's BCP document specifies that if the order management system is unavailable, orders should be taken by phone and recorded on paper forms. An auditor tests this procedure and discovers that the paper forms were redesigned two years ago but the BCP still references the old form numbers, and no staff member knows where current blank forms are stored. What BCP requirement did the organization fail to meet?

A. The BCP must be approved by legal counsel annually B. BCPs must be tested regularly to verify that manual procedures actually work and that responsible personnel know what to do; an untested BCP is a document with unverified assumptions C. The BCP must be stored in the cloud to ensure availability during disasters D. Manual procedures are not required in BCPs; only IT system recovery procedures are required

3. A ransomware attack has encrypted the primary data center servers. The organization's disaster recovery plan directs IT to restore operations at a secondary site with real-time data mirroring and fully operational infrastructure. What type of recovery site is the secondary location?

A. Cold site — provides space and power with no equipment, requiring full hardware procurement and setup B. Warm site — pre-configured hardware but requires data restoration from backups C. Hot site — fully operational with real-time data mirroring; can resume operations immediately with minimal data loss D. Mobile site — a portable data center that can be deployed to any location

4. During a security incident, a GDPR-regulated company's compliance officer is responsible for ensuring a 72-hour breach notification is submitted to the appropriate data protection authority. Which incident response role does this responsibility belong to?

A. IR team (technical responders) — they are responsible for all external communications during an incident B. Compliance officers — responsible for ensuring regulatory requirements are met during incident response, including mandatory breach notifications C. User community — responsible for reporting incidents to regulators D. Technical staff — responsible for submitting breach reports using technical logging systems

5. A software development team follows a methodology where they deliver working features every two weeks and adjust requirements based on stakeholder feedback each sprint. Security testing is integrated into each sprint cycle using automated SAST tools in the CI/CD pipeline. Which SDLC methodology is this?

A. Waterfall — security is integrated into the requirements phase at the beginning of each linear cycle B. Agile — iterative short development cycles with integrated security testing in each sprint; requirements evolve based on feedback C. DevOps — focuses entirely on deployment automation, not development cycles D. NIST SDLC — a government-specific development methodology

6. A network engineer makes an undocumented emergency change to a firewall rule to fix a connectivity issue late Friday night. The following week, a security audit reveals that the change opened an inbound port that is now being actively exploited. What change management policy requirement was violated, and what would have prevented this?

A. The engineer should have waited until Monday to make changes; weekend changes are always prohibited B. The change was undocumented and bypassed the approval and risk analysis process; proper change management would have required a risk assessment, approval, and documentation even for emergency changes C. The engineer lacked the technical certification required to modify firewall rules D. Change management policies only apply to software changes, not network infrastructure

Matching: Security Policy Concepts

Match each policy concept (1–4) to its correct description (A–D).

1RTO (Recovery Time Objective)

2Acceptable Use Policy

3Change management fallback procedure

4Business Impact Analysis (BIA)

AIdentifies which business functions are most critical, how long each can be suspended before unacceptable harm results, and what dependencies exist between functions

BThe maximum time an organization can tolerate being without a specific system or service before the business impact becomes unacceptable

CDefines permitted and prohibited uses of organizational systems; requires employee acknowledgment to limit organizational legal liability for employee misuse

DA documented rollback plan required for every system change; defines how to restore the previous state if the change fails or produces unacceptable results

Security Policies — Quiz