CSL Security Policy Development & Compliance 3

Question 1

A new regulation requires organizations to appoint a Data Protection Officer (DPO). Which policy document should be updated FIRST to reflect this governance change?

Accepted Answer

Information security charter or governance policy

Answer

The information security charter or governance policy defines organizational roles and accountability structures, making it the appropriate document to reflect a new mandated role.

Question 2

During a compliance audit, an auditor asks for evidence that the password policy is being enforced technically. Which artifact BEST demonstrates technical enforcement?

Accepted Answer

Active Directory group policy settings screenshot

Answer

Active Directory or directory service configuration screenshots show that password requirements are technically enforced rather than relying solely on user compliance.

Question 3

An organization's security policy states that all laptops must use full-disk encryption. An executive requests an exemption because encryption slows their device. What should the security team do FIRST?

Accepted Answer

Initiate a formal risk acceptance process documenting the risk and requiring executive sign-off

Answer

A formal risk acceptance process ensures the exception is documented, the residual risk is acknowledged, and accountability is assigned to the individual requesting the exemption.

Question 4

Which compliance framework uses a tiered approach where Tier 1 represents partial implementation and Tier 4 represents adaptive cybersecurity practices?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The NIST CSF defines four implementation tiers (Partial, Risk-Informed, Repeatable, Adaptive) to help organizations assess the maturity of their cybersecurity risk management practices.

Question 5

A security policy requires that all media containing sensitive data be sanitized before disposal. Which NIST publication provides the primary guidance on media sanitization techniques?

Accepted Answer

NIST SP 800-88

Answer

NIST SP 800-88, Guidelines for Media Sanitization, defines clearing, purging, and destroying methods appropriate for different media types and data sensitivity levels.

(CSL) Cybersecurity Leadership Certification Practice Test

(CSL) Cybersecurity Leadership Certification Practice Test

CSL Security Policy Development & Compliance 3