フリー問題

問題文

An operator of critical infrastructure is told that a regulation names no specific technology at all, yet inspectors will still judge whether the protection is adequate. Where does that push the security policy, and what does it require from the engineer?

選択肢

1. The regulation drives the security policy toward the current state, and the test activity it therefore requires from the engineer is the encryption algorithm check.
2. The regulation drives the security policy toward the internal preference, and the test activity it therefore requires from the engineer is the collected opinion survey.
3. The regulation drives the security policy toward the named product, and the test activity it therefore requires from the engineer is the installed version match.
4. The regulation drives the security policy toward the lowest cost, and the test activity it therefore requires from the engineer is the recorded evidence count.