CSS Security Policy Development & Enforcement 3

Question 1

What is the PRIMARY distinction between a security policy and a security standard?

Accepted Answer

Policies state what must be achieved; standards specify how to achieve it

Answer

Policies define high-level requirements and goals, while standards prescribe specific, measurable technical or operational requirements to meet those goals.

Question 2

Which stakeholder group is MOST critical to include during the initial development of an enterprise information security policy?

Accepted Answer

Senior leadership and legal counsel

Answer

Senior leadership provides authority and strategic alignment, while legal counsel ensures regulatory compliance — both are essential at the policy creation stage.

Question 3

A company implements a clean desk policy. Which type of security threat does this PRIMARILY mitigate?

Accepted Answer

Insider threat via unauthorized physical access to sensitive information

Answer

Clean desk policies reduce the risk that unauthorized individuals — including visitors or employees — view or take sensitive physical documents left unattended.

Question 4

Which metric BEST measures the effectiveness of a security policy enforcement program?

Accepted Answer

Rate of policy violations detected, investigated, and resolved

Answer

Tracking the full lifecycle of violations — detection, investigation, and resolution — demonstrates that enforcement mechanisms are actually functioning.

Question 5

During a merger, two organizations with conflicting data retention policies must operate together. What is the BEST approach?

Accepted Answer

Apply the stricter of the two retention policies enterprise-wide as an interim measure

Answer

Applying the stricter policy enterprise-wide minimizes legal and compliance risk while a unified policy is formally developed and approved.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS Security Policy Development & Enforcement 3