A healthcare organization's security team has implemented a new security awareness training program. The CISO wants to report to the board on the program's effectiveness. Which metric would be most meaningful to the board?

Reduction in the click rate on simulated phishing emails over time.

Number of simulated phishing emails sent.

Number of security incidents reported by employees.

Percentage of employees who completed the training.

A mid-sized retail company is developing its first formal security program. The CISO has been asked to produce a roadmap that aligns with the company's strategic goal of expanding into three new international markets over the next two years. The security team has limited resources and must show progress quickly. Which approach best balances strategic alignment with practical execution?

Implement all planned security controls immediately to ensure the company is fully protected before entering any new market.

Create a single comprehensive roadmap that addresses all security improvements equally across the organization, with a five-year horizon.

Develop a phased roadmap that prioritizes security capabilities needed for international market entry, with near-term milestones and measurable outcomes.

Focus the roadmap exclusively on compliance requirements for the new markets, deferring all other security improvements until after expansion.

A logistics company is considering implementing a security operations center (SOC) to improve threat detection and response. The board has asked for a business case. The company has no current formal security metrics. Which approach best builds the business case?

Propose implementing the SOC immediately and measure its effectiveness after deployment.

Present a business case that includes estimated cost of the SOC and a projection of reduced incident response time and potential loss avoidance.

State that the SOC is necessary because competitors have implemented one.

Describe the SOC's technology stack in detail to demonstrate its sophistication.

A utility company is introducing a new security program that includes network segmentation to protect critical infrastructure. The operations team is concerned that segmentation will complicate their monitoring. What is the best way to socialize the program to gain operations' support?

Explain how segmentation can actually improve monitoring by reducing noise and enabling focused alerts on critical systems.

Provide a detailed network diagram to the operations team.

Implement segmentation without informing the operations team until after it is complete.

Promise that segmentation will not change any of their current monitoring processes.

A media company is introducing a new security program that includes restricting access to sensitive content based on job role. The editorial team is concerned that this will hinder collaboration. What is the best way to socialize the program to gain editorial's support?

Implement the access controls immediately and provide a FAQ document afterward.

Explain how role-based access control protects unpublished content from leaks and ensures only authorized staff can access sensitive material.

Allow the editorial team to define their own access rules to avoid friction.

Provide a technical overview of the access control system to the editorial team.

GIAC Strategic Planning, Policy, and Leadership

Domain 2Objective 4

Security Program Development GSTRT Practice Questions (Page 3)

Part of the Policy and Program Management domain, which makes up ~45% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~32–54 in this domain), expect 8–14 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 11–15

11application · medium
A healthcare organization's security team has implemented a new security awareness training program. The CISO wants to report to the board on the program's effectiveness. Which metric would be most meaningful to the board?
Select an answer first
12application · medium
A mid-sized retail company is developing its first formal security program. The CISO has been asked to produce a roadmap that aligns with the company's strategic goal of expanding into three new international markets over the next two years. The security team has limited resources and must show progress quickly. Which approach best balances strategic alignment with practical execution?
Select an answer first
13application · medium
A logistics company is considering implementing a security operations center (SOC) to improve threat detection and response. The board has asked for a business case. The company has no current formal security metrics. Which approach best builds the business case?
Select an answer first
14application · medium
A utility company is introducing a new security program that includes network segmentation to protect critical infrastructure. The operations team is concerned that segmentation will complicate their monitoring. What is the best way to socialize the program to gain operations' support?
Select an answer first
15application · medium
A media company is introducing a new security program that includes restricting access to sensitive content based on job role. The editorial team is concerned that this will hinder collaboration. What is the best way to socialize the program to gain editorial's support?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSTRT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSTRT” is a trademark of its owner, used for identification only.