Managing the Program Structure GSLC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A mid-sized e-commerce company is building its security program structure. The CISO has a limited budget and must decide how to allocate resources. Which approach best ensures the program is effective while respecting the budget constraint?

   • AReduce spending on security awareness training to free up funds for technical controls.
   • BDistribute the budget evenly across all security domains to ensure balanced coverage.
   • CAllocate the majority of the budget to the latest security technologies to future-proof the program.
   • DPrioritize funding for controls that address the highest risks identified in a recent risk assessment, and defer lower-priority initiatives.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A newly appointed CISO is reviewing the security program structure of a company that has grown through acquisitions. Each acquired company has its own security program, policies, and tools. The CISO must create a unified program structure that supports the company's strategic goal of operating as one integrated enterprise while respecting local regulatory requirements. Which approach best achieves this?

   • ADevelop a common governance framework and security baseline, while allowing subsidiaries to maintain additional controls for local compliance.
   • BAdopt the security program of the largest acquired company as the enterprise standard.
   • CAllow each subsidiary to keep its own program and only report high-level metrics to the parent company.
   • DImmediately replace all subsidiary programs with a single global program and mandate full compliance.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A public sector organization is establishing a security program and must comply with government regulations that require clear accountability for security decisions. The organization has a hierarchical structure with multiple layers of management. Which role assignment best ensures clear accountability?

   • ADesignate a single senior executive as the accountable owner for the security program, with authority to make final decisions and report to the board.
   • BAssign accountability to the IT manager, who is responsible for implementing technical controls.
   • CCreate a committee of mid-level managers to make security decisions collectively.
   • DDistribute accountability across all department heads to ensure broad ownership.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A logistics company has implemented a security program and wants to measure its effectiveness. The CISO needs to select KPIs that will provide meaningful insight into the program's performance. Which KPI is most appropriate for measuring the effectiveness of the security program?

   • ANumber of security incidents that were detected and responded to within the defined service-level agreement (SLA).
   • BTotal number of security tools deployed across the organization.
   • CAmount of budget spent on security compared to the previous year.
   • DPercentage of employees who complete security awareness training within the required timeframe.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A mid-sized financial services firm is restructuring its security program to align with the organization's new strategic goal of expanding into international markets. The CISO wants the security program structure to support this expansion while maintaining compliance with multiple regional data protection regulations. Which approach best aligns the security program structure with the organization's strategic objectives?

   • AEstablish a centralized security program with a single set of policies and controls applied uniformly across all regions.
   • BOutsource security governance to a third-party managed security service provider to handle all regional compliance.
   • CDefer security program changes until the international expansion is fully completed and regional requirements are finalized.
   • DCreate a federated security program with regional security leads who adapt global policies to local regulatory and business needs.
   Reveal Solution Discussion Select an answer first