CompTIA CASP+ Practice Test

Security policies should be designed to...

1. Be flexible and adaptable

2. Remain unchanged for years

3. Focus solely on external threats

4. Ignore employee training requirements

The correct answer is: Be flexible and adaptable

Security policies should indeed be designed to be flexible and adaptable. This approach is essential because the threat landscape is constantly evolving, with new vulnerabilities, attack techniques, and compliance requirements emerging regularly. A rigid policy may not address evolving threats or changes in the organization’s operational needs and technology landscape. Flexibility allows organizations to respond swiftly to new information about potential threats, regulatory changes, or shifts in business processes. An adaptable security policy can incorporate lessons learned from incidents and take into account feedback from staff, making it more effective over time. This continuous improvement aspect is vital for maintaining a robust cybersecurity posture. In contrast, policies that remain unchanged for years might become outdated and ineffective, potentially exposing the organization to risks that it is not adequately prepared to handle. Similarly, focusing solely on external threats neglects the important consideration of internal risks and vulnerabilities. Ignoring employee training requirements could lead to increased human error, making the organization more susceptible to security breaches. Thus, the emphasis on flexibility and adaptability is crucial for developing relevant and effective security policies.