Security Program Analysis GSTRT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of considering organizational culture in security program analysis?

   • ATo replace technical security controls with cultural training
   • BTo understand how cultural norms and behaviors affect the effectiveness of security controls
   • CTo determine the exact number of security staff needed
   • DTo ensure all employees have the same security clearance
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A mid-sized financial services firm is conducting its annual security program assessment. The CISO notes that the current program has strong technical controls but the business is planning to launch a new mobile banking app within six months. The assessment team must evaluate whether the current security program can support this initiative. Which approach best aligns the assessment with the business objective?

   • AFocus the assessment solely on the existing on-premises infrastructure, since the mobile app will use cloud services managed by the provider.
   • BUse the previous year's assessment report as the baseline and only update the risk register with new threats.
   • CCompare current security capabilities against the projected requirements of the mobile banking app, including new threat vectors and compliance obligations.
   • DDefer the assessment until after the app launch to measure actual incidents rather than predicted gaps.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A nonprofit organization's core values emphasize transparency, collaboration, and minimal intrusion into donor privacy. The security team proposes a new monitoring solution that logs all employee web activity and flags any access to social media. The executive director is concerned about the cultural fit. What should the security team do to align the proposal with organizational values?

   • AImplement the monitoring as proposed because security must take priority
   • BCancel the monitoring initiative entirely to avoid any conflict with values
   • CModify the monitoring to focus on high-risk activities and clearly communicate the purpose
   • DAsk the IT department to monitor only senior executives to set an example
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A regional bank is expanding its digital services and plans to launch a mobile payment app within 12 months. The current security program has strong network perimeter controls and an experienced incident response team, but no formal vulnerability management process and limited cloud security expertise. The bank's board has asked the CISO to identify the most critical gap to address first to support the new initiative. What should the CISO prioritize?

   • ADeploy a cloud access security broker (CASB) to monitor all cloud traffic
   • BConduct a penetration test of the mobile app after development is complete
   • CEstablish a vulnerability management program covering the new app and its cloud infrastructure
   • DHire a cloud security architect to design the app's security architecture
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A construction company has a culture that values practical experience over formal training. Many field workers do not regularly check email. The security team is analyzing the program and needs to improve security awareness among field workers. What approach is most likely to be effective?

   • AProvide short, practical on-site briefings at safety meetings
   • BPost security posters in the main office only
   • CSend a detailed email newsletter about security best practices
   • DRequire all field workers to complete an online training module
   Reveal Solution Discussion Select an answer first