Managing the Program Structure GSLC Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A multinational corporation is aligning its security program with the organization's new strategic objective to enter a highly regulated market (e.g., pharmaceutical manufacturing). The current program is centralized, with all security decisions made at headquarters. The company's business units have historically operated with significant autonomy. The CISO must balance the need for consistent security governance with the flexibility required by regional regulatory differences. Which approach best reconciles these competing constraints?

   • ADelegate all security governance to each regional business unit to ensure full regulatory compliance.
   • BCreate a single global security policy that is so strict it satisfies the most stringent regulation worldwide.
   • CAdopt a hybrid governance model where global security policies set minimum standards and regional units can implement stricter controls to meet local regulations.
   • DMaintain the centralized structure but add regional compliance officers who report to the central CISO.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A financial institution's security program has been running for two years. An annual audit revealed several control gaps and a changing threat landscape. The CISO wants to ensure the program structure evolves to address these findings. Which action best supports continuous improvement?

   • AKeep the program structure unchanged to maintain consistency with the original design.
   • BIncrease the security budget without changing the program structure.
   • CReplace the entire security team to bring in fresh perspectives.
   • DUpdate the program's risk assessment and adjust controls and KPIs based on the audit findings.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A non-profit organization's security program has been operating for a year. The executive director wants to understand the program's value and progress. The CISO must establish a reporting mechanism that effectively communicates program status to the board. Which reporting approach is most appropriate?

   • AProvide the board with a detailed weekly technical report of all security incidents and vulnerabilities.
   • BPresent a one-time comprehensive report at the end of the fiscal year.
   • CGive the board access to the SIEM console so they can monitor security events in real time.
   • DSend a monthly dashboard that highlights key performance indicators, major risks, and progress against strategic goals.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary consideration when allocating budget for a security program?

   • AMatching the budget to the organization's risk profile and strategic priorities
   • BAllocating the same amount each year regardless of changes
   • CMinimizing budget to reduce costs
   • DSpending the entire budget before year-end to avoid cuts
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A mid-sized company has a security program with a flat budget. The CISO must choose between two initiatives: (1) upgrading the SIEM platform to improve threat detection, or (2) hiring a dedicated threat hunter. The company has a small security team that is currently overwhelmed with alerts. The board wants to see a reduction in mean time to detect (MTTD) and respond (MTTR). Which decision best addresses the board's objective within the budget constraint?

   • AUpgrade the SIEM platform because better detection technology directly reduces MTTD.
   • BHire the threat hunter because additional expertise can reduce both MTTD and MTTR by improving alert triage and response.
   • CSplit the budget between a partial SIEM upgrade and a part-time contractor.
   • DUse the budget to purchase additional threat intelligence feeds for the existing SIEM.
   Reveal Solution Discussion Select an answer first