Security Program Analysis GSTRT Practice Questions (Page 9)

Questions 41–44

1. 41expert · hard

   A defense contractor's core values include 'integrity and national security.' The security program assessment reveals that the company's supply chain is vulnerable to counterfeit components. The company's culture is hierarchical and security-conscious. The leadership is considering two options: implementing a blockchain-based supply chain tracking system or increasing physical inspections of incoming components. The blockchain system is innovative but may face resistance from the hierarchical culture. What should the security team recommend?

   • AIncrease physical inspections because they align with the existing culture and are easier to implement.
   • BImplement the blockchain system because it provides a tamper-evident record of the supply chain.
   • CRecommend a phased approach that starts with physical inspections and pilots the blockchain system in a limited scope, with leadership approval at each stage.
   • DOutsource the supply chain security to a third-party that specializes in blockchain tracking.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   During a security program review, the CISO wants to determine whether the current security investments are effectively supporting the organization's strategic business priorities. Which aspect of security program analysis does this focus on?

   • AAlignment with business objectives
   • BCompliance with regulatory standards
   • CTechnical architecture review
   • DIncident response readiness
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   A security manager is asked to provide a high-level view of the organization's current security posture, highlighting what is working well and where gaps exist relative to business goals. Which activity best describes this task?

   • AThreat modeling
   • BSecurity program assessment
   • CVulnerability scanning
   • DRisk treatment planning
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A software development company has a culture that values speed and autonomy. The security team is planning to introduce a new secure coding standard. The team must consider the culture to ensure adoption. What should the team do?

   • AOutsource code reviews to a third-party to enforce the standard externally.
   • BDelay the introduction until the next major release cycle to avoid disruption.
   • CMandate the standard and use automated tools to block any code that does not comply.
   • DInvolve developers in the creation of the standard and integrate it into their existing workflows with minimal friction.
   Reveal Solution Discussion Select an answer first