C3 LA-B B3 Policy

Which of the following statements accurately defines the responsibilities and reporting procedures for data security concerns in an organisation?

• All employees are responsible for ensuring data security, and any concerns should be reported to the IT department.

• The IT department is solely responsible for data security, and concerns should be reported directly to the department head.

• Only managers and department heads are responsible for data security, and concerns should be reported to them.

• Every employee has specific data security responsibilities based on their role, and concerns should be reported to a designated data security officer.

Answer explanation

Every employee has specific data security responsibilities based on their role, and concerns should be reported to a designated data security officer.

Which of the following statements accurately defines the responsibilities of employees with regard to data security policy?

• Employees are responsible for establishing and enforcing data security policies.

• Employees are not responsible for data security policies; it is the sole responsibility of IT department.

• Employees are responsible for ensuring that they understand and comply with data security policies.

• Employees are only responsible for data security policies if they hold a senior position within the organisation.

Answer explanation

Employees are responsible for ensuring that they understand and comply with data security policies.

Which of the following is an example of an acceptable password under a data security policy?

• 123456

• Password

• iloveyou

• $tr0ngP@$$w0rd

Which of the following statements best describes an acceptable software/installation/usage policy in relation to data security?

• Employees are allowed to download and install any software they need to complete their work.

• Employees must seek approval from their supervisor before downloading and installing any software.

• Employees are not allowed to install any software on their computers.

• Employees can only use software that is approved by the company's IT department.

Answer explanation

Allowing employees to download and install any software they need can lead to the installation of unauthorised and potentially harmful software on company devices. While completely banning software installation may seem like a safe option, it can restrict employee productivity. Seeking approval from a supervisor can create unnecessary bureaucracy and delays. Therefore, the best policy is to only allow the use of approved software, as determined by the company's IT department, to ensure that all software is secure and compliant with data security policies.

Which of the following is the best example of a security parameter for device hardening in a data security policy?

• Ensuring that all devices are updated with the latest operating system version

• Allowing employees to use personal devices for work-related tasks

• Providing unrestricted access to sensitive data to all employees

• Storing login credentials in a publicly accessible file

Answer explanation

This is the best example of a security parameter for device hardening because outdated operating systems are more vulnerable to attacks. Ensuring that all devices are updated with the latest operating system version can help protect against known vulnerabilities and reduce the risk of a security breach.

Which of the following is NOT an example of a security parameter for device hardening?

• Enabling firewalls

• Disabling unnecessary services

• Installing anti-virus software

• Leaving default usernames and passwords

Answer explanation

Leaving default usernames and passwords is a major security risk because attackers can easily gain access to the device. Therefore, it is important to change default usernames and passwords during device hardening. Enabling firewalls, disabling unnecessary services, and installing anti-virus software are all examples of security parameters that should be considered during device hardening to improve data security.

Which of the following is true about disaster recovery in data security policy?

• It is solely the responsibility of the IT department

• It is the responsibility of all employees in the organisation

• It is the responsibility of the CEO only

• It is not necessary for disaster recovery to be a part of data security policy

Answer explanation

Disaster recovery is not the sole responsibility of the IT department. Every employee in the organisation has a role to play in ensuring that disaster recovery plans are in place and that they are followed in the event of a disaster. All employees should be trained on what to do in case of a disaster, and there should be clear guidelines in place for disaster recovery. This will help to minimize the impact of a disaster on the organization and ensure that business operations can be restored as quickly as possible.

Which of the following is a DO for employees in regards to disaster recovery in a company's data security policy?

• Keep a backup of all data on personal devices.

• Store all passwords and sensitive data in easily accessible locations.

• Report any security breaches or suspicious activity to the IT department immediately.

• Share login credentials with colleagues when requested.

Answer explanation

Reporting security breaches or suspicious activity to the IT department as soon as possible is crucial in mitigating potential damage caused by a security incident. Keeping a backup of all data on personal devices and storing passwords and sensitive data in easily accessible locations can actually increase the risk of a security breach. Sharing login credentials with colleagues is also a security risk as it makes it difficult to trace who has accessed what data.

Which of the following is a DO for employees regarding disaster recovery in a Data Security policy?

• Employees should make backups of all their files and keep them on their work computer.

• Employees should keep their passwords written down and stored in a desk drawer.

• Employees should report any suspicious activity or security breaches to their IT department immediately.

• Employees should share their login credentials with their coworkers to improve collaboration.

Answer explanation

Reporting any suspicious activity or security breaches immediately can help to prevent further damage and limit the impact of a security incident. Making backups of files is also important, but they should be stored in a secure location. Keeping passwords written down and sharing login credentials are both DON'Ts and can compromise the security of the organisation's data.

Which of the following is NOT a best practice for defining a backup process in a data security policy?

• Backing up all important data on a regular basis

• Scheduling backups during off-peak hours

• Using encrypted media for backup storage

• Storing backup media in an unlocked cabinet

Answer explanation

Storing backup media in an unlocked cabinet poses a significant security risk, as it makes it easy for unauthorised individuals to access and steal sensitive data. It is important to ensure that backup media is stored securely, such as in a locked cabinet or off-site location. Backing up all important data on a regular basis, scheduling backups during off-peak hours, and using encrypted media for backup storage are all recommended best practices for a data security policy.