Which item is not listed as part of a network security review?

• A. Data backup policy
• B. Network device hardening standards
• C. Approval process when connecting new devices or firewall rule changes
• D. Outbound scans for malware, malicious/blacklisted sites, data policy violations

Answer: (A)

In a network security review, the focus is on protections that directly control and monitor the network itself. This includes how devices are securely configured and hardened, the governance around bringing new devices online or changing firewall rules, and how outbound traffic is scanned for malware, malicious sites, or policy violations. A data backup policy, while essential for data resilience and recovery, pertains to data protection and disaster recovery rather than the network’s security controls. It addresses backing up and restoring data, not securing or overseeing network access and traffic. Therefore, the item not listed as part of a network security review is the data backup policy.