Managing the Program Structure GSLC Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A financial services company is allocating its security budget for the next fiscal year. The CISO faces a trade-off: investing in advanced threat detection tools versus increasing the security awareness training program. The company has a mature technical infrastructure but has experienced several phishing incidents that led to credential compromise. The executive team wants to reduce the risk of credential-based attacks. Which allocation strategy best addresses this risk?

   • AReduce the training budget and use the funds to hire additional security analysts to monitor for credential misuse.
   • BInvest heavily in advanced threat detection tools to catch phishing emails before they reach users.
   • CSplit the budget evenly between training and new tools to balance both approaches.
   • DIncrease funding for security awareness training and phishing simulations, while maintaining current threat detection tools.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A multinational corporation has a security program with multiple regional offices. The CISO needs to report security status to the executive leadership team, which is concerned about both overall risk reduction and regional compliance. The CISO has limited time in the quarterly meeting. What reporting approach best balances these needs?

   • ASend a written report to executives and do not present it in the meeting, to save time.
   • BPresent a detailed report for each region, including all compliance metrics and incident details.
   • CProvide a global dashboard with aggregated KPIs, supplemented by a brief narrative on regional compliance highlights and exceptions.
   • DFocus only on global metrics and omit regional details to keep the report concise.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the purpose of defining key performance indicators (KPIs) for a security program?

   • ATo guarantee that all security incidents are prevented
   • BTo assign blame for security failures
   • CTo measure the effectiveness and progress of the program
   • DTo replace the need for security audits
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A startup is in the process of initiating a security program. The CISO has limited resources and wants to establish a foundation that can grow. Which action is most appropriate for the initiation phase?

   • AHire a large security team to ensure comprehensive coverage from the start.
   • BImmediately purchase and deploy a full suite of security tools to establish a strong technical foundation.
   • CDevelop a detailed security policy document before any other activity.
   • DConduct a risk assessment to identify the most critical assets and threats, and use the results to define initial security objectives.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A regional bank is integrating its security program with the enterprise risk management (ERM) framework. The CISO wants to ensure that security decisions align with the bank's strategic risk appetite. Which structural approach best supports this alignment?

   • ADelegate all security investment decisions to the CISO to maintain agility and avoid bureaucratic delays.
   • BEstablish a security steering committee with representation from ERM, legal, and business unit leaders to review and approve major security initiatives.
   • CCreate a separate security risk register that operates independently from the enterprise risk register.
   • DOutsource security governance to an external consultancy to ensure independent, unbiased risk decisions.
   Reveal Solution Discussion Select an answer first