Program Management CAS-005 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is rolling out a new security policy that requires encryption of all laptops. The policy is met with resistance from employees who fear performance impacts. The CISO wants to ensure a smooth rollout and maintain employee morale. Which communication strategy is most effective?

   • ASend a single email announcing the policy and provide a link to the technical documentation.
   • BImplement the policy silently and inform employees only after it is in effect.
   • CMandate the policy with a strict deadline and communicate that non-compliance will result in disciplinary action.
   • DCommunicate the business rationale, provide a pilot program for early adopters, and offer a feedback channel to address concerns.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team needs to provide monthly reports to executive management on the status of security incidents and compliance activities. The reports must be easy to understand and highlight trends and areas of concern. Which approach best meets these needs?

   • AProvide a verbal update during the monthly executive meeting without written documentation.
   • BDistribute a summary of all security incidents, including every minor event, to ensure transparency.
   • CSend a detailed technical report with raw logs and incident data to the executive team.
   • DCreate a dashboard with key performance indicators (KPIs) and trend charts, and provide a brief narrative summary of notable incidents and compliance gaps.
   Reveal Solution Discussion Select an answer first
4. 23foundation · medium

   In a RACI matrix, what is the role of the person marked as 'Responsible'?

   • AThey are kept up-to-date on progress but not involved in details
   • BThey perform the work to complete the task
   • CThey provide input and expertise before the work begins
   • DThey are ultimately answerable for the outcome
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A multinational company must comply with GDPR, CCPA, and other data protection regulations. The privacy team wants to implement a single privacy training program that meets all regulatory requirements. The program must be scalable and auditable. Which approach is most effective?

   • ARely on external legal counsel to provide training on all regulations as needed.
   • BDevelop a modular privacy training program with a core module on general data protection principles and add-on modules for specific regulations (GDPR, CCPA) and roles.
   • CProvide separate training programs for each regulation, delivered independently to all employees.
   • DCreate a single, comprehensive training course that covers all regulations in equal detail for every employee.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A large organization has a mature security awareness program with a low phishing click rate. The CISO wants to further reduce risk by focusing on high-risk departments (finance and HR) and improving reporting of suspicious emails. The security team has limited budget and must justify the program's value. Which approach is most effective?

   • AContinue the current program and add a monthly newsletter with phishing tips for all employees.
   • BReplace the current program with a one-time, intensive training session for finance and HR departments.
   • CImplement targeted phishing simulations for high-risk departments with tailored scenarios, and track click and report rates to demonstrate improvement.
   • DIncrease the frequency of phishing simulations for all employees to monthly, with no additional targeting.
   Reveal Solution Discussion Select an answer first