Discuss ISC2 ISSEP Exam Topic 5 Question 44

A security policy is an overall general statement produced by senior management that dictates what

role security plays within the organization. Which of the following are required to be addressed in a

well designed policy? Each correct answer represents a part of the solution. Choose all that apply.

AWhat is being secured?

BWho is expected to comply with the policy?

CWhere is the vulnerability, threat, or risk?

DWho is expected to exploit the vulnerability?

Suggested Answer: A, B, C

A security policy is an overall general statement produced by senior management (or a selected

policy board or committee) that dictates what

role security plays within the organization.

A well designed policy addresses the following:

What is being secured? - Typically an asset.

Who is expected to comply with the policy? - Typically employees.

Where is the vulnerability, threat, or risk? - Typically an issue of integrity or responsibility.

Get Premium ISSEP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

11 comments · newest first

Rikki 11 months ago

Isn't it obvious that we need to address vulnerabilities?

Lajuana 12 months ago

I think identifying threats is super important too.

Jackie 12 months ago

Compliance is key! Everyone should know the rules.

Daniel 12 months ago

Wait, who would exploit the vulnerability? That seems off.

Huey 1 year ago

Definitely need to know what is being secured!

Belen 1 year ago

I’m a bit confused about option D. I don’t think the policy should focus on who exploits vulnerabilities, right? That seems off.

Kattie 1 year ago

I feel like we covered the importance of identifying vulnerabilities and risks in our last practice exam. So, option C might be a key part of the policy.

Bernardo 1 year ago

I’m not entirely sure, but I remember something about compliance being important too. Maybe option B is correct?

Kimberlie 1 year ago

I think we discussed that a security policy should definitely address what is being secured. That seems fundamental.

Georgiana 1 year ago

Hmm, I'm a bit unsure about this one. I'll have to think it through carefully. Maybe I can visualize how the projection changes as the latitude of origin shifts.

Kirk 1 year ago

Hmm, this one seems straightforward. I think I'll go with option A - entering the MAC address in the correct Endpoint Identity Group.

ISC2 ISSEP Exam - Topic 5 Question 44 Discussion