Policies must specify acceptable network locations for the technologies. Which choice is correct?

• A. Network locations are not defined
• B. Acceptable network locations for the technology are defined
• C. Only for on-site networks
• D. Only for remote networks

Answer: (B)

The main idea is that security policies must clearly state where a technology is allowed to operate within the network. Defining acceptable network locations ensures controls are applied in trusted, appropriate segments and makes enforcement and audits possible. If locations aren’t defined, deployments could occur in insecure areas, weakening security and compliance. Saying that acceptable network locations for the technology are defined covers all needed deployments and provides a complete, consistent policy. Restricting to only on-site or only remote networks would miss valid deployment scenarios and fail to provide a full policy.