Security Program Development GSTRT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A university is developing a security roadmap. The IT department wants to prioritize cloud migration, while the research division insists on maintaining on-premises systems for sensitive research data. The university's strategic plan emphasizes becoming a leader in data-driven research. How should the security team approach the roadmap to align with these competing priorities?

   • APrioritize cloud migration exclusively because it is the industry trend and will modernize the university.
   • BDevelop a roadmap that includes both cloud migration and on-premises security enhancements, with a phased approach that allows for hybrid operations.
   • CFocus the roadmap on maintaining on-premises systems to avoid the complexity of cloud security.
   • DCreate separate roadmaps for each department without attempting to align them.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A government agency is launching a security awareness program. The program manager wants to ensure ongoing support from employees and managers. Which approach is most likely to sustain engagement?

   • AUse a single annual training session to minimize disruption
   • BInvolve managers in designing the program and provide regular feedback on progress
   • COffer a one-time reward for completing the training
   • DMake the training mandatory and track completion rates
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A CISO is building a business case for a new identity and access management (IAM) system. The company has experienced several insider threat incidents. The CFO is concerned about the cost. Which approach best justifies the investment?

   • AEmphasize that the IAM system is a best practice and will improve compliance with regulations.
   • BQuantify the financial impact of past insider threat incidents and show how the IAM system reduces the likelihood of future incidents.
   • CCompare the IAM system's features with those of competitors.
   • DPropose a phased implementation to spread the cost over multiple years.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which element is essential to include in a business case for a new security program?

   • AA detailed list of all potential security technologies available on the market
   • BA cost-benefit analysis that quantifies expected costs and benefits, including risk reduction
   • CA guarantee that the program will eliminate all security incidents
   • DA summary of the security team's preferred vendor relationships
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail company is rolling out a new security program that includes stricter access controls and regular vulnerability scans. The CISO anticipates resistance from the sales team, who fear the new controls will slow down their work. What is the best way to socialize the program to gain their buy-in?

   • AOffer a bonus to employees who comply with the new security policies.
   • BSend a company-wide email explaining the new policies and the consequences of non-compliance.
   • CHold a meeting with sales leadership to explain the benefits and address their concerns about productivity.
   • DImplement the controls quietly and only inform employees after they are in place.
   Reveal Solution Discussion Select an answer first