Security+ Policies Standards Procedures Quiz

1. Which framework is commonly used for risk management in organizations?

ITIL

NIST RMF (Risk Management Framework)

Agile methodology

Six Sigma

2. What is the primary goal of security program management oversight?

To eliminate all business operations

To ensure security objectives align with organizational goals

To increase system complexity

To reduce employee autonomy

3. The purpose of a vendor management policy is to:

Eliminate all third-party relationships

Ensure vendors meet security requirements

Increase IT spending

Replace internal security teams

4. A security audit should be conducted:

Only when breaches occur

Annually and after significant changes

Never, as it wastes resources

Only for external compliance

5. Which control type focuses on preventing security incidents before they occur?

Detective controls

Corrective controls

Preventive controls

Compensating controls

6. A business continuity plan should address:

Employee vacation scheduling

How operations resume after disruptions

Marketing campaign strategies

Vendor discount negotiations

7. What is the primary benefit of implementing a security governance structure?

To eliminate the need for technical controls

To provide oversight and accountability for security decisions

To reduce employee productivity

To avoid compliance requirements

8. A security control assessment typically evaluates:

Employee salaries and benefits

Whether controls are implemented and effective

Only technical security measures

Vendor pricing agreements

9. What does the principle of least privilege require?

Granting all users administrator rights

Users receive only necessary access for their roles

Eliminating all user access controls

Providing equal access to all resources

10. A baseline configuration serves primarily to:

Reduce hardware costs

Establish a standard secure state for systems

Eliminate the need for patching

Replace antivirus software

11. What is the main goal of a change management policy?

To prevent all system modifications

To ensure changes are approved and documented

To eliminate the need for testing

To reduce IT department workload

12. Which of the following is a key component of a security awareness program?

Regular training on security policies and threats

Limiting employee internet access

Eliminating all user passwords

Outsourcing all security functions

13. A procedure is best described as:

A high-level security objective

A step-by-step instruction for performing a task

A legal compliance requirement

A recommendation for future planning

14. What does a data classification policy typically include?

Employee names and contact information

Classification levels and handling requirements

Individual performance reviews

Vendor contract terms

15. A security standard differs from a security policy in that it:

Is mandatory rather than advisory

Specifies how policies are implemented

Applies only to external vendors

Never requires compliance audits

16. Which type of policy defines rules for acceptable use of company resources?

Data retention policy

Acceptable use policy

Incident response policy

Change management policy

17. What is the primary purpose of a security policy?

To document all IT hardware assets

To establish rules and expectations for security behavior

To replace the need for technical controls

To eliminate all organizational risk

18. Which framework provides a structured approach to information security management systems (ISMS)?

ISO/IEC 27001

NIST SP 800-53

CIS Controls

COBIT 5

19. Which document outlines the organization's overall security direction and commitment?

Security baseline

Security strategy or security policy

Incident response plan

Business continuity plan

20. Which NIST publication provides security control recommendations for federal information systems?

SP 800-12

SP 800-30

SP 800-53

SP 800-88

Security+ Security Policies Standards and Procedures Quiz