GSEC Security Policy and Risk Management Quiz

1. An acceptable use policy typically governs which of the following?

Employee conduct with organizational IT resources

Physical access to the data center

Vendor contract terms

Insurance coverage levels

Submit

4. What does 'least privilege' mean in access control?

Users should have only the minimum access needed for their job

All users should have full system access

Access controls are unnecessary

Administrators should have limited access

5. Which of the following is a key component of an incident response plan?

Detection, containment, eradication, and recovery procedures

Marketing strategies

Employee vacation schedules

Financial forecasts

6. A vulnerability is best defined as which of the following?

A weakness that can be exploited by a threat

A successful attack on a system

A security policy violation

An insurance claim

7. In the risk management lifecycle, which phase comes after risk assessment?

Risk response planning

Risk identification

Risk monitoring

Risk documentation

8. What is the goal of a security baseline?

Establish minimum security standards for systems and environments

Achieve maximum security at any cost

Eliminate the need for risk assessments

Replace security policies

9. Which compliance standard specifically addresses healthcare data protection?

HIPAA

PCI DSS

SOX

GDPR

10. What is the primary benefit of security awareness training?

Increase employee understanding of security policies and threats

Replace technical security controls

Eliminate the need for passwords

Reduce IT department staffing

11. Which risk management process involves identifying potential threats and vulnerabilities to organizational assets?

Risk assessment

Risk mitigation

Risk acceptance

Risk monitoring

12. Which risk response strategy involves taking specific actions to reduce risk?

Risk mitigation

Risk acceptance

Risk avoidance

Risk transference

13. What does 'due diligence' mean in the context of security governance?

Taking reasonable precautions to identify and manage security risks

Eliminating all possible threats

Transferring all risk to insurance

Avoiding security investments

14. A data classification policy typically includes which of the following categories?

Public, internal, confidential, restricted

Low, medium, high, critical

Employee, contractor, vendor, customer

Network, application, database, endpoint

15. Which of the following is NOT a typical security governance structure?

Security steering committee

Chief Information Security Officer (CISO)

Security operations center

Marketing department

16. What is the purpose of a Business Impact Analysis (BIA)?

Identify critical business functions and potential impacts of disruption

Eliminate all operational risks

Replace disaster recovery plans

Calculate exact security spending

17. In risk management, what does 'likelihood' refer to?

The probability that a threat will occur

The financial loss from a threat

The time required to detect a threat

The number of vulnerabilities present

18. Which framework provides a structured approach to managing information security risks?

NIST Cybersecurity Framework

ISO 27001

COBIT

All of the above

19. A security policy that specifies how passwords must be created and managed is an example of which policy type?

Acceptable use policy

Access control policy

Authentication policy

Data classification policy

20. What is the primary goal of a security policy?

Establish guidelines and expectations for information security

Eliminate all security risks

Replace technical controls

Reduce IT costs