Security policy development in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the Purpose of Security Policies

What is the primary purpose of a security policy in an organization?

A To list all software licenses owned by the organization

B To provide detailed technical instructions for configuring firewalls

C To define rules and guidelines for protecting organizational assets

D To describe the company’s marketing strategies

💡 Hint

Think about what a security policy aims to achieve at a high level.

A security policy sets the rules and guidelines to protect the organization's information and assets. It is not about technical details or unrelated business areas.

📋 Factual

intermediate

Key Components of a Security Policy

Which of the following is NOT typically a component of a security policy?

A Access control rules

B Employee salary details

C Incident response procedures

D Acceptable use guidelines

💡 Hint

Consider what information is relevant to security policies.

Employee salary details are confidential HR information and not part of security policies. Security policies focus on rules for access, use, and incident handling.

🔍 Analysis

advanced

Analyzing Policy Enforcement Challenges

Which challenge is most likely to reduce the effectiveness of a security policy?

Consider how policies are applied in real organizations.

A Policies are too complex and hard to understand

B Policies are written in simple language

C Policies are reviewed regularly and updated

D Policies include clear roles and responsibilities

💡 Hint

Think about what happens if employees cannot easily follow the rules.

If policies are too complex, employees may ignore or misunderstand them, reducing their effectiveness. Clear, simple policies help ensure compliance.

❓ Comparison

advanced

Comparing Policy Types

Which statement correctly compares mandatory and discretionary access control policies?

A Discretionary policies are more strict than mandatory policies

B Discretionary policies are enforced by the system; mandatory policies are decided by users

C Mandatory policies allow users to share access freely; discretionary policies do not

D Mandatory policies restrict access based on fixed rules; discretionary policies allow owners to decide access

💡 Hint

Think about who controls access in each policy type.

Mandatory access control uses fixed rules set by the system or organization. Discretionary access control lets resource owners decide who can access their resources.

❓ Reasoning

expert

Evaluating Policy Update Frequency

An organization updates its security policy only once every five years. What is the most likely risk of this approach?

A The policy may become outdated and fail to address new threats

B The policy will cause frequent system crashes

C The policy will be too flexible to enforce

D Employees will become too familiar with the policy

💡 Hint

Consider how fast technology and threats change.

Security threats evolve quickly. Updating policies infrequently risks missing new threats and vulnerabilities, reducing protection.