Security Program Analysis GSTRT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A multinational corporation is assessing its security program across regional offices. The assessment finds that the Asia-Pacific region has a high rate of security incidents, while the European region has a low rate. The corporate culture is decentralized, with regional autonomy. What should the security team do to improve the program?

   • AReplace the regional security leads with corporate headquarters staff.
   • BMandate a single global security policy and enforce it uniformly across all regions.
   • CFocus resources only on the Asia-Pacific region because it has the most incidents.
   • DAnalyze the regional differences in culture and operations to identify why the Asia-Pacific region is underperforming, then adapt best practices.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A mid-sized insurance company has a security program that is technically strong but has low employee compliance with security policies. The company's culture is highly autonomous, and employees resist centralized controls. The company is planning to acquire a smaller firm that has a very different, compliance-driven culture. The CISO must analyze the current program and plan for the merger. What is the most important consideration?

   • AImpose the acquiring company's security policies on the acquired firm immediately
   • BIntegrate the two cultures gradually while maintaining security controls that respect autonomy
   • CFocus only on technical integration and ignore cultural differences
   • DAdopt the acquired firm's compliance-driven culture entirely
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When analyzing a security program, a leader ensures that security decisions reflect the organization's stated principles and mission. Which concept is being applied?

   • ABenchmarking
   • BCulture consideration
   • COrganizational values integration
   • DRisk appetite definition
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security leader is tasked with anticipating the security capabilities the organization will need in the next three years, considering the adoption of new technologies and the evolving threat landscape. Which practice does this describe?

   • AVendor risk management
   • BCompliance auditing
   • CFuture needs forecasting
   • DSecurity program assessment
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A technology company's core values include 'innovation and disruption.' The security team is assessing a new initiative to allow employees to bring their own devices (BYOD) to work. The company's culture is flexible and trusts employees. The assessment must incorporate the company's values. What is the best approach?

   • AReject BYOD because it increases security risk and conflicts with the need for control.
   • BImplement BYOD with a mobile device management (MDM) solution that enforces security policies while allowing personal use.
   • CProvide company-owned devices only, eliminating the BYOD option.
   • DAllow BYOD without any restrictions to respect the culture of trust.
   Reveal Solution Discussion Select an answer first