Security Program Development GSTRT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A government agency has implemented a new security information and event management (SIEM) system. The security director wants to define metrics to report to senior leadership on the program's effectiveness. Which metric would be most meaningful for senior leadership?

   • APercentage of SIEM rules that are custom-developed.
   • BNumber of SIEM administrators on staff.
   • CMean time to detect (MTTD) and mean time to respond (MTTR) for security incidents.
   • DNumber of SIEM alerts generated per day.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a business case for a security initiative, how should risk justification be presented?

   • ABy listing all past security incidents regardless of relevance
   • BBy comparing the cost of the initiative to the potential financial impact of the risks it mitigates
   • CBy stating that the initiative is required by industry best practices
   • DBy describing the technical details of the security controls to be deployed
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A healthcare organization has implemented a new security awareness training program. The security manager wants to define metrics to measure the program's effectiveness and support decisions about future training investments. Which metric would be most meaningful for this purpose?

   • ANumber of security awareness training sessions conducted per quarter.
   • BPercentage of employees who completed the training module.
   • CTotal budget spent on the training program.
   • DChange in the rate of successful phishing simulations before and after training.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A manufacturing company is considering implementing a security program that includes both endpoint protection and employee training. The CFO has approved only a limited budget and wants to see a business case that justifies the allocation. The company has experienced both malware infections and phishing incidents. Which approach best builds the business case?

   • AFocus the business case on employee training only, since it is less expensive.
   • BFocus the business case on endpoint protection only, since malware incidents have caused more downtime.
   • CPresent a cost-benefit analysis that quantifies the financial impact of both malware and phishing incidents and shows the expected reduction from each control.
   • DPresent a qualitative argument that both controls are necessary without financial analysis.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is developing metrics to report to the board. The board is concerned about cyber risk and wants to see progress over time. Which metric would be most effective for the board?

   • ATrend of mean time to remediate critical vulnerabilities over the past year
   • BNumber of security incidents reported in the last quarter
   • CNumber of security awareness training sessions completed
   • DPercentage of systems with up-to-date patches
   Reveal Solution Discussion Select an answer first