Security Program Development GSTRT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A hospital is considering investing in a new security awareness training program. The CFO is skeptical about the return on investment. The hospital has experienced several phishing-related incidents that compromised patient data. Which approach best builds the business case for the training program?

   • AState that the training program will reduce the number of phishing incidents.
   • BCompare the cost of the training program to the estimated cost of a single data breach, including fines and reputational damage.
   • CProvide a detailed syllabus of the training content.
   • DHighlight that the training program is recommended by industry best practices.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A retail company has implemented a new web application firewall (WAF) to protect its e-commerce platform. The security team wants to define metrics to measure the WAF's effectiveness. Which metric would be most meaningful?

   • ANumber of WAF rules configured.
   • BUptime of the WAF service.
   • CPercentage of malicious requests blocked by the WAF.
   • DNumber of alerts generated by the WAF per day.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is implementing a new security program that includes network segmentation and stricter access controls. The IT operations team is concerned about the impact on system performance and their workload. The CISO wants to ensure the program is successfully adopted. What is the best approach?

   • AOutsource the implementation to a third party to avoid burdening IT operations.
   • BInvolve IT operations in the planning phase and address their concerns about performance and workload.
   • CImplement the changes quickly to minimize the disruption to IT operations.
   • DProvide additional training to IT operations after the implementation.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A healthcare organization has implemented a comprehensive security program. The security director must report to the board on the program's effectiveness. The board is concerned about both patient data protection and operational efficiency. Which set of metrics would best support the board's decision-making?

   • AA dashboard showing the number of security incidents, percentage of systems patched, and average time to remediate critical vulnerabilities.
   • BA report detailing the number of security tools deployed and their costs.
   • CA list of all security policies and procedures that have been implemented.
   • DA summary of the security team's daily activities and tasks completed.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which activity is most effective for socializing a security program with business unit leaders?

   • APublishing the security program plan on the internal website
   • BSending a mass email with a summary of the program
   • CWaiting for leaders to ask questions about the program
   • DHolding one-on-one meetings to discuss how the program affects each business unit
   Reveal Solution Discussion Select an answer first