CSS Security Policy Development & Enforcement 3 — Questions and Answers
Question 1: What is the PRIMARY distinction between a security policy and a security standard?
- Policies are optional; standards are mandatory
- Policies state what must be achieved; standards specify how to achieve it (Correct answer)
- Standards apply to all employees; policies apply only to IT staff
- Policies require executive approval; standards do not
Correct answer: Policies state what must be achieved; standards specify how to achieve it
Policies define high-level requirements and goals, while standards prescribe specific, measurable technical or operational requirements to meet those goals.
Question 2: Which stakeholder group is MOST critical to include during the initial development of an enterprise information security policy?
- External auditors
- Senior leadership and legal counsel (Correct answer)
- Front-line IT staff
- Third-party vendors
Correct answer: Senior leadership and legal counsel
Senior leadership provides authority and strategic alignment, while legal counsel ensures regulatory compliance — both are essential at the policy creation stage.
Question 3: A company implements a clean desk policy. Which type of security threat does this PRIMARILY mitigate?
- Phishing attacks
- Insider threat via unauthorized physical access to sensitive information (Correct answer)
- Malware infection via removable media
- Brute-force password attacks
Correct answer: Insider threat via unauthorized physical access to sensitive information
Clean desk policies reduce the risk that unauthorized individuals — including visitors or employees — view or take sensitive physical documents left unattended.
Question 4: Which metric BEST measures the effectiveness of a security policy enforcement program?
- Number of policies published on the intranet
- Percentage of employees who have signed the acceptable use policy
- Rate of policy violations detected, investigated, and resolved (Correct answer)
- Time elapsed since the last policy was written
Correct answer: Rate of policy violations detected, investigated, and resolved
Tracking the full lifecycle of violations — detection, investigation, and resolution — demonstrates that enforcement mechanisms are actually functioning.
Question 5: During a merger, two organizations with conflicting data retention policies must operate together. What is the BEST approach?
- Apply the stricter of the two retention policies enterprise-wide as an interim measure (Correct answer)
- Allow each legacy organization to keep its own policy indefinitely
- Delete all data to avoid conflicts during the transition
- Ignore retention policies until the merger is legally finalized
Correct answer: Apply the stricter of the two retention policies enterprise-wide as an interim measure
Applying the stricter policy enterprise-wide minimizes legal and compliance risk while a unified policy is formally developed and approved.
Question 6: Which concept describes the practice of ensuring that security policies align with and support the organization's overall business objectives?
- Risk appetite
- Security governance (Correct answer)
- Vulnerability management
- Defense in depth
Correct answer: Security governance
Security governance ensures that security policies, processes, and resources are aligned with business strategy and organizational objectives.
Question 7: An organization's password policy mandates a minimum 12-character length. A system cannot enforce this requirement due to a technical limitation. What control type should be applied?
- Detective control
- Preventive control
- Compensating control (Correct answer)
- Corrective control
Correct answer: Compensating control
A compensating control is used when the primary required control cannot be implemented, providing an alternative means of meeting the security objective.
CSS Security Policy Development & Enforcement 3
What is the PRIMARY distinction between a security policy and a security standard?