Information Security Policy Quiz

What is the primary responsibility of a policy maker in an organization?

• To enforce laws

• To set the information resource security policy

• To manage IT infrastructure

• To conduct audits

Which of the following is NOT a type of information security policy?

• Enterprise information security program policy

• Issue-specific information security policy

• System-specific security policy

• User-specific security policy

What must policies be able to do if challenged in court?

• Be supported by all employees

• Stand up in court

• Be easily understood

• Be flexible and adaptable

Which of the following is a component of an Issue-Specific Security Policy (ISSP)?

• Detailed guidance on resource use

• General security guidelines

• High-level strategic direction

• Technical specifications for systems

What is a key element of the policy development process?

• Ignoring employee feedback

• Involving end users in policy formulation

• Creating policies without management approval

• Distributing policies only to IT staff

What is the purpose of access control lists (ACLs)?

• To monitor network traffic

• To regulate user access to systems

• To create backup procedures

• To define user roles

Which of the following describes a standard in the context of information security policy?

• A nonmandatory recommendation

• A detailed statement of compliance requirements

• A set of organizational guidelines

• A step-by-step instruction manual

What is the first step in the policy development process?

• Reviewing existing policies

• Drafting the policy document

• Distribution of the policy

• Implementation of the policy

What should be included in the maintenance phase of policy management?

• Periodic review of the policy

• Immediate enforcement of penalties

• Creation of new policies

• Elimination of outdated policies

Which of the following is a barrier to employees reading policies?

• Too many meetings

• Overabundance of policies

• Literacy or language issues

• Lack of interest