Security Program Analysis GSTRT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A government contractor's core values include integrity, accountability, and public service. The security team is evaluating a new threat intelligence platform that would automatically share threat data with a commercial vendor. The legal team raises concerns about data privacy and the contractor's obligation to protect sensitive information. What should the security team do to align with organizational values?

   • AAsk the vendor to sign a non-disclosure agreement and then share all data
   • BReject the platform entirely because any data sharing is unacceptable
   • CProceed with the platform because threat intelligence sharing is a security best practice
   • DReview the data-sharing agreement and configure the platform to share only non-sensitive indicators
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A family-owned retail chain has a culture of trust and informal communication. Employees frequently share passwords to access shared systems, and the current security policy prohibits this but is rarely enforced. The company's values emphasize family and mutual support. The security manager is conducting a program analysis and must address the password-sharing issue. What is the most effective approach?

   • AIgnore the issue because the culture values trust over security
   • BTerminate employees who share passwords to enforce the policy strictly
   • CImplement single sign-on and educate employees on why sharing is risky
   • DChange the policy to allow password sharing among family members
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following inputs is most relevant when forecasting future security needs for an organization?

   • AEmerging threat intelligence and planned business expansion
   • BHistorical incident reports only
   • CCurrent firewall configuration logs
   • DEmployee satisfaction survey results
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A manufacturing company currently relies on legacy on-premises systems and has no cloud presence. The company plans to double its e-commerce sales in two years and will migrate customer-facing systems to a public cloud provider. The security team currently uses a traditional perimeter-focused model. What is the most important future security requirement to plan for now?

   • APurchasing additional on-premises firewalls to handle increased traffic
   • BImplementing identity-centric access controls and cloud-native monitoring
   • CCreating a data loss prevention policy for on-premises file servers
   • DHiring more incident responders to handle a larger attack surface
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A non-profit organization has a culture of openness and information sharing, with few formal security controls. The security program assessment reveals that employees frequently share sensitive donor information via unencrypted email. The organization's leadership values collaboration. What is the most effective way to address this issue while respecting the culture?

   • AAccept the risk because the organization's culture is more important than security.
   • BProvide training on secure communication methods and implement a user-friendly encrypted email solution.
   • CDisable email for all employees until a secure solution is implemented.
   • DImplement a strict policy prohibiting the sharing of donor information via email and enforce it with technical controls.
   Reveal Solution Discussion Select an answer first