A Security Assessor Is Working with an Organization to Review

question 19

Multiple Choice

A security assessor is working with an organization to review the policies and procedures associated with managing the organization's virtual infrastructure. During a review of the virtual environment, the assessor determines the organization is using servers to provide more than one primary function, which violates a regulatory requirement. The assessor reviews hardening guides and determines policy allows for this configuration. It would be MOST appropriate for the assessor to advise the organization to:

• A) segment dual-purpose systems on a hardened network segment with no external access
• B) assess the risks associated with accepting non-compliance with regulatory requirements
• C) update system implementation procedures to comply with regulations
• D) review regulatory requirements and implement new policies on any newly provisioned servers

---

Definitions:

Policy Statements

Official documents that outline an organization's principles, intentions, and positions on various issues.

Procedural Changes

Adjustments or modifications made to the established way of doing things, often to improve efficiency or effectiveness.

Neutral

A position or stance that does not favor any side in a dispute, competition, or debate.

Recommendation Letters

Written endorsements of an individual's character, abilities, and achievements, typically used for job or academic applications.