Managing the Program Structure GSLC Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A global e-commerce company must design its security program structure to comply with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). The company operates in multiple regions and wants a single, cohesive program. Which design consideration is most important when incorporating these regulatory requirements?

   • ADesign the program to meet only GDPR requirements because it is the most comprehensive regulation.
   • BMap each regulatory requirement to specific data flows and processes, then design controls that satisfy the applicable obligations per region.
   • CCreate separate, independent security programs for each regulatory region to avoid conflicts.
   • DAdopt the strictest requirement from either regulation and apply it globally to all data subjects.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of aligning the security program structure with an organization's governance framework?

   • ATo guarantee that all security controls are automated
   • BTo eliminate the need for executive oversight
   • CTo replace the organization's governance framework with a security-specific one
   • DTo ensure security decisions are consistent with the organization's overall direction and risk appetite
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A manufacturing company has just completed the initial implementation of its security program. The CISO wants to ensure the program continues to meet evolving business needs. Which action is most appropriate for the next phase of the program lifecycle?

   • AImmediately begin planning a complete redesign of the program based on the latest industry trends.
   • BFreeze all security changes for one year to ensure stability and allow the organization to adapt to new processes.
   • CConduct a post-implementation review to assess whether security controls are operating as intended and identify gaps for improvement.
   • DMove all security monitoring to a managed security service provider to reduce internal workload.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A technology company's security program has been in operation for two years. The CISO wants to implement a continuous improvement process. Which action is most aligned with this goal?

   • AIncrease the security budget by 10% each year to ensure the program has more resources.
   • BConduct an annual review of security policies and update them based on lessons learned from incidents and changes in the threat landscape.
   • CReplace the security program with a new framework every year to keep up with industry trends.
   • DMaintain the current program unchanged to ensure stability and predictability.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the first phase in the lifecycle of a security program?

   • AEvaluation
   • BImplementation
   • CInitiation
   • DContinuous improvement
   Reveal Solution Discussion Select an answer first