Managing the Program Structure GSLC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A manufacturing company is integrating its security program with its operational technology (OT) environment. The security team has little experience with OT systems, while the plant engineers understand the machinery but not security. The CISO wants to ensure clear accountability for security decisions affecting the OT environment. Which role assignment best supports this integration?

   • AAssign the plant engineers full responsibility for all security decisions in the OT environment.
   • BOutsource all OT security decisions to an external industrial control system security vendor.
   • CCreate a joint security-OT working group with a designated security liaison and an OT representative who co-own security decisions.
   • DAssign the security team full responsibility and require them to learn OT systems on their own.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of a clearly defined security role?

   • AThe help desk is responsible for setting security policy
   • BThe marketing manager is responsible for firewall rule changes
   • CThe CFO is responsible for daily log monitoring
   • DThe Chief Information Security Officer (CISO) is responsible for the overall security vision and strategy
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large enterprise has a security program with many KPIs, but the CISO is concerned that the KPIs are not driving improvement. The executive team wants to see a clear link between security activities and business outcomes. Which approach is most effective for revising the KPI framework?

   • ASet KPIs once and do not change them to ensure consistent measurement over time.
   • BIncrease the number of KPIs to capture every aspect of the security program.
   • CAlign KPIs with business risk priorities, such as reducing the likelihood of a data breach, and review them quarterly with business unit leaders.
   • DUse only technical KPIs, such as number of vulnerabilities patched, to maintain objectivity.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large enterprise's security program has multiple stakeholders: the board, business unit managers, IT operations, and external auditors. Each group requires different information from the security program. The CISO must establish a reporting mechanism that satisfies all stakeholders without overwhelming them. Which reporting strategy is most effective?

   • AReport only to the board and let them disseminate information to other stakeholders.
   • BProvide real-time access to all security data to every stakeholder through a self-service dashboard.
   • CSend the same comprehensive monthly report to all stakeholders to ensure consistency.
   • DCreate tailored reporting packages for each stakeholder group, with different levels of detail and frequency.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A software development company's security program has implemented a vulnerability management process. The CISO wants to measure the effectiveness of this process. Which key performance indicator (KPI) is most appropriate for this purpose?

   • AAverage time to remediate critical vulnerabilities (MTTR).
   • BNumber of security tools deployed in the environment.
   • CNumber of security policies approved by the board.
   • DTotal number of employees in the security team.
   Reveal Solution Discussion Select an answer first