Managing the Program Structure GSLC Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A retail company is integrating its security program with its software development lifecycle (SDLC). The goal is to ensure that security is considered throughout the development process without slowing down releases. Which approach best achieves this integration?

   • ARequire a full security review by the central security team before every release, regardless of the change's size.
   • BRun security testing only on production systems after deployment to avoid interfering with development.
   • CEmbed security champions within each development team and provide them with authority to approve security requirements at each SDLC phase.
   • DAdd a security checklist to the end of the SDLC and have developers self-certify compliance.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which of the following best describes how a security program structure should relate to an organization's strategic objectives?

   • AIt should focus solely on compliance requirements
   • BIt should be designed to support and enable those objectives
   • CIt should operate independently to avoid business interference
   • DIt should prioritize security over all business goals
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A logistics company is integrating its security program with its supply chain management process. The security team wants to ensure that security requirements are embedded in vendor onboarding and ongoing monitoring. Which integration approach is most effective?

   • AOutsource vendor security assessments to a third-party firm and only review their reports annually.
   • BRequire all vendors to sign a security policy but do not change the onboarding workflow.
   • CAdd a security review step to the existing vendor onboarding workflow and assign a security representative to the vendor management team.
   • DCreate a separate security approval process that runs independently of the vendor management workflow.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A manufacturing company is designing its security program structure. The company has a matrix organizational structure where employees report to both functional and project managers. The CISO needs to ensure that security responsibilities are clear despite the matrix. Which approach is most effective?

   • ARely on informal communication to ensure security tasks are completed.
   • BDefine security roles and responsibilities in a RACI matrix that clarifies who is accountable, responsible, consulted, and informed for each security task.
   • CCreate a separate security department that operates independently of the matrix to avoid confusion.
   • DAssign all security responsibilities to the IT department since they manage the technical infrastructure.
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A security program has been in the 'operate and maintain' phase for three years. The organization is undergoing a major digital transformation, moving many services to the cloud. The CISO must decide whether to initiate a new program lifecycle phase or continue with the existing structure. The program's KPIs show declining effectiveness in the new cloud environment. Which decision is most appropriate?

   • AContinue the current program and make minor adjustments to existing controls.
   • BInitiate a new program lifecycle phase focused on cloud security, including a revised risk assessment and updated KPIs.
   • CMaintain the current program but increase the budget to address cloud-specific threats.
   • DRetire the current program and start from scratch with a completely new security program.
   Reveal Solution Discussion Select an answer first