policy vs encryption = management vs technical staff. Which is more important? I choose policy because CISSP needs you to think like a manager..

I'm for the "B", encryption is part of the policy.

CHAT GP

A is more specific. If the security policy outdated or even the policy is not developed yet?

B encompasses A. B is more comprehensive than A. B could include access control and other control measures not specific to integrity or the like.

I feel it's B. Because you need to monitor and enforce. This includes due diligence and care. Security policy would tell you 5 W's. I'm going with B.

Correct Answer is B. all training suggests policy is typically the best answer. it may even encompass all of the rest of the less correct answers.

I think the key word is ENFORCE adherence to security policies, as policies include not only encryption requirements but other things to protect data, acceptable use for instance.

Remember Rule #1 on the CISSP exam: Think like a manager. So I'm convinced it's B.

Note the word data asset, not data itself, so B is the answer

in option B . There is no clear indication as they are secure policies. So can't trust those policies if they are outdated.

Encryption addresses the confidentiality . What about the integrity and availability of the data . . It should be policy

encrypting the data at rest and in transit is great for those who are unauthorized. However, the question is not that specific, reading that it applies to all types of users (authorized and not). When accounting for this interpretation of the question, B makes more sense. Additionally, B doesn't JUST list having or monitoring a policy, it is specific to also say enforce which implies technical controls.

Policy > Standards > Procedures > Guidelines CBK, 6th Edition, Figure 1.3

Answer A) you can implement all the security policies you want, but something will happen sooner or later. If you encrypt everything first, then it provides the BEST protection against theft/loss.

A, because you always pick the answer with humanless involvement when comes to security because human is not trustable. You learn this from Kelly Handerhan!

The best way to protect an organization's data assets is not a single method, but a combination of multiple methods that address different aspects and layers of data security. However, among the four options given, the most comprehensive and effective one is A. Encrypt data in transit and at rest using up-to-date cryptographic algorithms. Option B. Monitor and enforce adherence to security policies is a good practice for ensuring compliance and awareness of data security standards and regulations, but it does not directly protect data from attacks or breaches.