Security and Risk Management GISP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization wants to improve its security culture by implementing a security awareness program. The program must be tailored to different employee roles and measure its effectiveness. Which approach best meets these requirements?

   • AConduct quarterly phishing simulations and report the click rate to management.
   • BProvide role-based training modules and track completion rates and quiz scores.
   • CSend monthly security tips via email and track open rates.
   • DDeliver a single annual training video to all employees and conduct a follow-up survey.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A global e-commerce company processes customer data in multiple regions. The company is expanding into a new country that has strict data localization requirements. The company's current cloud provider does not have a data center in that country. The legal team advises that the data must reside within the country's borders. The company is evaluating options. Which approach best balances compliance and operational continuity?

   • AUse a local cloud provider in the new country and replicate data back to the company's primary region for disaster recovery.
   • BDelay the expansion until the current cloud provider builds a data center in the new country.
   • CEncrypt all data before storing it in the new country to satisfy the localization requirement.
   • DEstablish a local data center in the new country and ensure all data processing and storage for that region occurs there.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A multinational corporation is adopting a security management framework to align its security program with business goals and regulatory requirements. The company operates in multiple countries with different privacy laws. Which framework would be most appropriate to provide a comprehensive, risk-based approach that can be adapted to various regulatory environments?

   • AISO/IEC 27001, because it provides a certifiable, risk-based management system that can be tailored to different legal contexts.
   • BCIS Controls, because it is a comprehensive framework that covers all aspects of security governance.
   • CCOBIT, because it focuses exclusively on IT security controls.
   • DNIST SP 800-53, because it is a mandatory federal standard that applies to all organizations.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In the risk management process, what is the primary purpose of the risk identification step?

   • ATo document and list potential risks that could affect the organization
   • BTo decide which risks to accept, avoid, transfer, or mitigate
   • CTo monitor and review the effectiveness of risk responses
   • DTo determine the likelihood and impact of each identified risk
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is developing a new security policy for remote work. The policy must balance security with employee productivity. The company has a diverse workforce, including employees in different time zones and with varying technical skills. Which approach is most likely to achieve both security and usability?

   • AFocus on technical controls and avoid written policies to reduce administrative burden.
   • BDevelop a policy with role-based requirements and provide clear procedures and training for each role.
   • CDelegate policy development to each department to ensure buy-in.
   • DCreate a single, strict policy that applies to all employees regardless of role or location.
   Reveal Solution Discussion Select an answer first