Managing the Program Structure GSLC Practice Questions (Page 12)

Questions 56–57

1. 56expert · hard

   A security program has defined several KPIs, but the CISO notices that some KPIs are not aligned with the organization's strategic objectives. For example, the program tracks the number of security awareness training sessions delivered, but the organization's main goal is to reduce the impact of security incidents. The CISO must revise the KPI set. Which KPI revision best aligns with the strategic objective?

   • AAdd a KPI measuring the average financial loss per security incident.
   • BRemove all KPIs and rely on qualitative assessments from the security team.
   • CKeep the training session count but add a KPI for the number of phishing simulations conducted.
   • DReplace the training session count with a KPI measuring the percentage of employees who pass a security awareness assessment.
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   Which of the following is an example of integrating security into a business process?

   • AKeeping security policies separate from operational procedures
   • BConducting security audits only after an incident
   • CAssigning security tasks only to the security team
   • DIncluding a security review as part of the project management lifecycle
   Reveal Solution Discussion Select an answer first