Security Program Analysis GSTRT Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A manufacturing company has a culture of continuous improvement and employee empowerment. The company is planning to implement industrial IoT (IIoT) sensors on the factory floor to improve efficiency. The security team must forecast future security needs. The current program has no OT security expertise. What is the most critical future requirement?

   • APurchase cyber insurance to cover potential IIoT incidents
   • BTrain existing IT staff on OT security basics
   • CWait until the IIoT devices are installed and then assess the risks
   • DDevelop an OT security strategy that includes network segmentation and device management
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A government contractor has a hierarchical, risk-averse culture where decisions are made at the top. The security program assessment identifies a critical vulnerability in a legacy system, but the remediation requires significant downtime. The security team must present the findings to leadership. How should the team frame the recommendation to align with the organizational culture?

   • ARecommend immediate remediation regardless of downtime, emphasizing the technical severity.
   • BDefer the recommendation until the next scheduled system maintenance window.
   • CPresent the technical details of the vulnerability and let the technical team decide the remediation timeline.
   • DProvide a risk-based analysis with options, including downtime trade-offs, and recommend a decision for leadership approval.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A financial services firm has a hierarchical culture where decisions are made by senior management and employees are expected to follow procedures exactly. The security team wants to introduce a new phishing simulation program. What is the most culturally appropriate way to implement it?

   • APilot the program with a small team and then present results to senior management for approval
   • BAsk employees to vote on whether to participate in the program
   • CLaunch the program immediately and let employees learn from the experience
   • DOutsource the phishing simulation to a vendor without internal communication
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A retail company has a strong brand reputation for customer privacy. The security program is mature, but the company is planning to launch a loyalty program that will collect extensive customer data. The CISO must analyze the program's alignment with business objectives. What is the most critical consideration?

   • AEnsuring the security program can protect the new customer data and maintain the brand's privacy reputation
   • BSelecting a loyalty program vendor with the lowest price
   • CDetermining the cost of the loyalty program's marketing campaign
   • DEnsuring the loyalty program is available on all mobile platforms
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A hospital has a culture of rapid decision-making and high trust in clinicians. The security team is analyzing the program and finds that clinicians often bypass security controls to access patient data quickly. The hospital is planning to implement a new electronic health record (EHR) system. What is the most effective way to address the culture's impact on security?

   • ADiscipline clinicians who bypass controls to enforce compliance
   • BWork with clinicians to design workflows that are both secure and efficient
   • CDelay the EHR implementation until the culture changes
   • DImplement stricter access controls and monitor clinicians' behavior
   Reveal Solution Discussion Select an answer first