Managing the Program Structure GSLC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of defining a security program structure within an organization?

   • ATo document the organization's security policies and procedures
   • BTo organize security activities, resources, and governance into a coherent framework that supports the organization's objectives
   • CTo ensure that all security controls are automated
   • DTo assign a single individual responsible for all security decisions
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A healthcare organization's security program is underfunded. The CISO must allocate a limited budget across several initiatives: upgrading endpoint detection, hiring a security analyst, and implementing a new SIEM tool. The organization's board requires measurable improvement in threat detection and response. Which resource allocation decision best supports the program's objectives within the budget constraint?

   • AAllocate most of the budget to hiring the analyst and use the remainder for a basic endpoint detection tool.
   • BUse the budget to hire a consultant to develop a security strategy instead of purchasing tools.
   • CSpend the entire budget on the SIEM tool because it provides the most comprehensive visibility.
   • DSplit the budget evenly among all three initiatives to ensure balanced coverage.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A newly formed cybersecurity department in a large enterprise is defining its program structure. The CISO wants to ensure that the structure supports both strategic governance and day-to-day operations. Which structural element is most essential to include?

   • AA governance committee that sets security policy and a separate operational team that executes security controls and responds to incidents.
   • BAn external advisory board that makes all security decisions for the organization.
   • CA structure that focuses solely on technical controls and does not include policy or governance components.
   • DA single team that handles both policy development and incident response to maximize efficiency.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A hospital is integrating its security program with clinical operations. The security team wants to enforce strict access controls on medical devices, but clinicians are concerned that these controls will slow down patient care. The CISO must assign responsibility for access decisions to balance security and clinical needs. Which role assignment best reconciles these competing requirements?

   • AGive the security team sole authority to set access controls on all medical devices.
   • BAssign a single 'security champion' from the clinical staff to make all access decisions.
   • CEstablish a joint clinical-security committee that reviews and approves access control policies, with escalation paths for urgent exceptions.
   • DGive clinicians sole authority to decide access controls based on patient care needs.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A retail chain is integrating its security program with its supply chain management process. The company wants to ensure that security requirements are included in vendor contracts and that vendors are monitored for compliance. However, the procurement team is concerned about slowing down the vendor onboarding process. Which approach best balances security and operational efficiency?

   • AInclude security requirements in contracts but do not perform any vendor assessments to speed up the process.
   • BDevelop a tiered vendor security assessment process that applies more rigorous reviews to high-risk vendors and a streamlined process for low-risk vendors.
   • COutsource vendor security assessments to a third-party to reduce the burden on the procurement team.
   • DRequire all vendors to undergo the same comprehensive security assessment to ensure consistency.
   Reveal Solution Discussion Select an answer first