nerdexam
Isaca

CISM · Question #88

An organization provides notebook PCs, cable wire locks, smartphone access, and virtual private network (VPN) access to its remote employees. Which of the following is MOST important for the…

The correct answer is A. Employees are trained on the acceptable use policy. Given the provision of various tools and access methods for remote work, it is most important to ensure employees are trained on the acceptable use policy to govern proper and secure utilization.

Submitted by lars.no· Apr 18, 2026Information Security Program Development and Management

Question

An organization provides notebook PCs, cable wire locks, smartphone access, and virtual private network (VPN) access to its remote employees. Which of the following is MOST important for the information security manager to ensure?

Options

  • AEmployees are trained on the acceptable use policy.
  • BEmployees use smartphone tethering when accessing from remote locations.
  • CEmployees use the VPN when accessing the organization's online resources.
  • DEmployees physically lock PCs when leaving the immediate area.

How the community answered

(44 responses)
  • A
    84% (37)
  • B
    9% (4)
  • C
    2% (1)
  • D
    5% (2)

Why each option

Given the provision of various tools and access methods for remote work, it is most important to ensure employees are trained on the acceptable use policy to govern proper and secure utilization.

AEmployees are trained on the acceptable use policy.Correct

Training employees on the acceptable use policy (AUP) is paramount because it defines the rules for using all provided resources, including PCs, smartphones, and VPNs, ensuring they are used securely and in compliance with organizational policies, which underpins the effectiveness of all other security measures. Without proper understanding of the AUP, the other security tools may be misused or bypassed.

BEmployees use smartphone tethering when accessing from remote locations.

Suggesting employees use smartphone tethering is not a security measure, and it can introduce additional risks if not properly secured, making it an inappropriate primary action.

CEmployees use the VPN when accessing the organization's online resources.

While using the VPN is critical for secure access, ensuring training on the AUP (which would cover VPN usage) is a broader, more fundamental security measure that encompasses all provided tools.

DEmployees physically lock PCs when leaving the immediate area.

Physically locking PCs is a good practice, but it's a specific action covered by an AUP or security policy, making employee training on the overarching AUP more important than focusing on just one aspect.

Concept tested: Security awareness and acceptable use policy

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/adopting-a-security-posture

Topics

#Acceptable Use Policy#Security Awareness Training#Policy Enforcement#Remote Access Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISM Practice