CSS Security Policy Development & Enforcement 5

Question 1

Which policy type governs the overall information security program and is typically signed by the CEO or Board?

Accepted Answer

Program policy

Answer

A program policy (also called an organizational or master policy) establishes the overall security program, its scope, and executive commitment at the highest organizational level.

Question 2

During policy development, the security team discovers that implementing a required control will cost significantly more than the risk it mitigates. What is the BEST course of action?

Accepted Answer

Document a formal risk acceptance and explore cost-effective compensating controls

Answer

When control costs exceed risk value, formal risk acceptance by appropriate leadership — combined with compensating controls — is the proper risk management response.

Question 3

A newly hired employee is onboarded without completing security policy acknowledgment. Which risk does this PRIMARILY create?

Accepted Answer

Inability to enforce policy violations against the employee legally

Answer

Without a signed acknowledgment, the organization lacks documented proof that the employee was informed of policies, weakening any disciplinary or legal action for violations.

Question 4

Which practice ensures that security policies address emerging threats not anticipated when the policies were originally written?

Accepted Answer

Conducting threat-intelligence-informed policy gap analysis

Answer

Threat-intelligence-informed gap analysis compares current policy coverage against emerging threat vectors to identify and address policy deficiencies proactively.

Question 5

What is the MAIN purpose of separating duties within a security policy governance structure?

Accepted Answer

To ensure no single individual can both create and approve policy changes without oversight

Answer

Separation of duties in governance prevents conflicts of interest and fraud by ensuring that policy creation, review, and approval are handled by different individuals or groups.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS Security Policy Development & Enforcement 5