Security Program Management and Oversight practice questions

Guidelines are the only advisory artifact in the governance hierarchy; policies, standards and procedures are mandatory.

Because the company cannot require any configuration on routers it does not own, the document can only recommend. That is a guideline. Standards, policies and procedures all carry a mandatory expectation that the company could not enforce here.

1. Identify the deciding constraint: no authority to require anything.
2. Recall which governance documents are mandatory: policies, standards, procedures.
3. Recall which is advisory: guidelines.
4. Choose the advisory document.

Exam tip: If compliance can only be recommended, the document is a guideline.

Changes flow down the governance hierarchy: a policy states intent, a standard sets the measurable requirement, and procedures implement the standard.

Changes flow down the hierarchy, not up. The policy's intent (protect data in transit) is unchanged, so it does not need revising when a protocol version is dropped; that detail lives in the encryption standard. Procedures are written to implement the standard, so any configuration steps that enable TLS 1.1 are now out of compliance and must be updated. The acceptable use policy and the reference architecture do not specify protocol versions.

1. Ask what changed: a specific, measurable requirement in a standard.
2. Ask whether the higher-level intent changed: it did not, so the policy stays.
3. Ask which documents implement the standard: procedures.
4. Update the documents beneath the standard.

Exam tip: A standard change ripples down to procedures, not up to the policy.

Benchmarks are guidelines that give consensus secure-configuration settings for a specific platform.

Consensus-based, vendor-neutral, platform-specific hardening recommendations are exactly what an industry benchmark provides; CIS Benchmarks are the best-known example. An advisory covers one issue, an RFC covers protocols, and a reference architecture covers solution design.

1. Identify the need: secure settings for one platform.
2. Note the sources: consensus-based and vendor-neutral.
3. Match platform hardening recommendations to a benchmark.

Exam tip: Hardening settings for a platform come from a benchmark.

Advisories are guidance issued by vendors or agencies about a specific vulnerability or threat, with affected versions and mitigations.

The notice is about one newly found flaw, lists affected versions and gives an interim workaround; that is the content of a security advisory. A vulnerability disclosure policy is the tempting near-twin, but it governs how outsiders report flaws to the organization, not what the vendor tells customers afterwards.

1. Note the direction: vendor to customers.
2. Note the content: one flaw, affected versions, workaround.
3. Separate it from a policy for receiving reports.
4. Match it to an advisory.

Exam tip: A vendor's notice about a specific flaw and its mitigation is an advisory.

Reference architectures are vendor-neutral designs used before products are chosen; implementation guides are product-specific deployment instructions.

The two stages need different documents. The design must exist before a vendor is chosen and must let bids be compared, so it has to be a vendor-neutral model of components and interactions: a reference architecture. Deploying a specific product in a supported configuration is what that vendor's implementation guide covers. A benchmark helps harden a platform's settings but neither describes the solution's design nor replaces the vendor's supported deployment steps.

1. Identify the first need: a vendor-neutral design.
2. Match it to a reference architecture.
3. Identify the second need: deploying a chosen product correctly.
4. Match it to the vendor's implementation guide.

Exam tip: Design from a reference architecture; deploy from the implementation guide.

A baseline is a standard that sets the minimum secure configuration for a system type and the reference point for drift detection.

The requirements are a mandatory, documented minimum configuration for every new server and a reference point to detect deviation. That is a security baseline. An implementation guide may inform it, but it is vendor guidance rather than the organization's mandatory benchmark for drift.

1. Note the requirement: the same minimum configuration everywhere.
2. Note the second requirement: detect deviation later.
3. Recall that drift is measured against a baseline.
4. Choose the baseline.

Exam tip: Same minimum configuration for every build, with drift checked against it, means a baseline.