- Policy Hierarchy
- Writing Style and Technique
- Policy Format
- Summary
- Multiple Choice Questions
- Exercises
- Projects
- Reference
This chapter is from the book
This chapter is from the book
This chapter is from the book
Multiple Choice Questions
1. The policy hierarchy is the relationships between which of the following?
Guiding principles, regulations, laws, and procedures
Guiding principles, standards, guidelines, and procedures
Guiding principles, instructions, guidelines, and programs
None of the above
2. Which of the following statements best describes the purpose of a standard?
To state the beliefs of an organization
To reflect the guiding principles
To dictate mandatory requirements
To make suggestions
3. Which of the following statements best describes the purpose of a guideline?
To state the beliefs of an organization
To reflect the guiding principles
To dictate mandatory requirements
To help people conform to a standard
4. Which of the following statements best describes the purpose of a baseline?
To measure compliance
To ensure uniformity across a similar set of devices
To ensure uniformity and consistency
To make suggestions
5. Simple step, hierarchical, graphic, and flowchart are examples of which of the following formats?
Policy
Program
Procedure
Standard
6. Which of the following terms best describes instructions and guidance on how to execute an initiative or how to respond to a situation, within a certain time frame, usually with defined stages and with designated resources?
Plan
Policy
Procedure
Package
7. Which of the following statements best describes a disadvantage to using the singular policy format?
The policy can be short.
The policy can be targeted.
You may end up with too many policies to maintain.
The policy can easily be updated.
8. Which of the following statements best describes a disadvantage to using the consolidated policy format?
Consistent language is used throughout the document.
Only one policy document must be maintained.
The format must include a composite management statement.
The document may end up being very long.
9. Policies, standards, guidelines, and procedures should all be in the same document.
True
False
Only if the company is multinational
Only if the documents have the same author
10. Version control is the management of changes to a document and should include which of the following elements?
Version or revision number
Date of authorization or date that the policy took effect
Change description
All of the above
11. What is an exploit?
A phishing campaign
A malicious program or code designed to exploit, or take advantage of, a single vulnerability or set of vulnerabilities
A network or system weakness
A protocol weakness
12. The name of the policy, policy number, and overview belong in which of the following sections?
Introduction
Policy heading
Policy goals and objectives
Policy statement
13. The aim or intent of a policy is stated in the ________.
introduction
policy heading
policy goals and objectives
policy statement
14. Which of the following statements is true?
A security policy should include only one objective.
A security policy should not include any exceptions.
A security policy should not include a glossary.
A security policy should not list all step-by-step measures that need to be taken.
15. The _________ contains the rules that must be followed.
policy heading
policy statement
policy enforcement clause
policy goals and objectives list
16. A policy should be considered _____.
mandatory
discretionary
situational
optional
17. Which of the following best describes policy definitions?
A glossary of terms, abbreviations, and acronyms used in the document that the reader may be unfamiliar with
A detailed list of the possible penalties associated with breaking rules set forth in the policy
A list of all the members of the security policy creation team
None of the above
18. The _________ contains the penalties that would apply if a portion of the security policy were to be ignored by an employee.
policy heading
policy statement
policy enforcement clause
policy statement of authority
19. What component of a security policy does the following phrase belong to? “Wireless networks are allowed only if they are separate and distinct from the corporate network.”
Introduction
Administrative notation
Policy heading
Policy statement
20. There may be situations in which it is not possible to comply with a policy directive. Where should the exemption or waiver process be explained?
Introduction
The policy statement
Policy enforcement clause
Policy exceptions
21. The name of the person/group (for example, executive committee) that authorized the policy should be included in the ___________________.
version control table or policy statement
heading or policy statement
policy statement or policy exceptions
version control table or policy heading
22. When you’re drafting a list of exceptions for a security policy, the language should _________________.
be as specific as possible
be as vague as possible
reference another, dedicated document
None of the above
23. If supporting documentation would be of use to the reader, it should be __________________.
included in full in the policy document
ignored because supporting documentation does not belong in a policy document
listed in either the policy heading or administrative notation section
included in a policy appendix
24. When writing a policy, standard, guideline, or procedure, you should use language that is ___________.
technical
clear and concise
legalese
complex
25. Readers prefer plain language because it __________________.
helps them locate pertinent information
helps them understand the information
saves time
All of the above
26. Which of the following is not a characteristic of plain language?
Short sentences
Using active voice
Technical jargon
Seven or fewer lines per paragraph
27. Which of the following is the best term to use when indicating a mandatory requirement?
must
shall
should not
may not
28. A company that uses the term “employees” to refer to workers who are on the company payroll should refer to them throughout their policies as _________.
workforce members
employees
hired hands
workers
29. Which of the following statements is true regarding policy definitions?
They should be included and maintained in a separate document.
The general rule is to include definitions for any topics except technical, legal, or regulatory language.
The general rule of policy definitions is to include definitions for any instance of industry-specific, technical, legal, or regulatory language.
They should be created before any policy or standards.
30. Even the best-written policy will fail if which of the following is true?
The policy is too long.
The policy is mandated by the government.
The policy doesn’t have the support of management.
All of the above.