PT0-001 · Question #182
A company's corporate policies state that employees are able to scan any global network as long as it is done within working hours. Government laws prohibit unauthorized scanning. Which of the…
The correct answer is D. The employee must obtain written approval from the company's Chief Information Security Officer. When company policies permit scanning but government laws restrict unauthorized scanning, obtaining written CISO authorization resolves the conflict by formally making the activity legally authorized.
Question
A company's corporate policies state that employees are able to scan any global network as long as it is done within working hours. Government laws prohibit unauthorized scanning. Which of the following should an employee abide by?
Options
- ACompany policies must be followed in this situation
- BLaws supersede corporate policies
- CIndustry standards receding scanning should be followed
- DThe employee must obtain written approval from the company's Chief Information Security Officer
How the community answered
(27 responses)- A4% (1)
- B19% (5)
- C7% (2)
- D70% (19)
Why each option
When company policies permit scanning but government laws restrict unauthorized scanning, obtaining written CISO authorization resolves the conflict by formally making the activity legally authorized.
Following company policy alone does not make the scanning legally authorized, because government laws override internal corporate policies when the two conflict.
Simply concluding that laws supersede policy does not resolve the situation, because the law prohibits only unauthorized scanning, and proper written authorization can make the activity lawful.
Industry standards are not legally enforceable and do not satisfy the formal authorization requirement imposed by government law.
Government laws prohibit 'unauthorized' scanning, not scanning itself, so obtaining written CISO approval converts a potentially unauthorized act into an authorized one that satisfies both the legal requirement and corporate process. This approach recognizes that the legal prohibition hinges on authorization status, and formal written approval from the CISO establishes that necessary authorization. It also creates a documented chain of accountability that protects the employee legally if the activity is later questioned.
Concept tested: Legal authorization and policy hierarchy for network scanning
Topics
Community Discussion
No community discussion yet for this question.