Security Program Development GSTRT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What characteristic makes a security metric meaningful for measuring program effectiveness?

   • AIt remains constant over time to allow easy comparison
   • BIt is easy to calculate from existing logs
   • CIt is directly linked to a security objective and supports decision-making
   • DIt produces a large number that impresses leadership
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A multinational corporation is rolling out a new security program that includes data classification and access controls. The marketing department is resistant, fearing it will slow down their ability to share campaign materials. The security team must gain buy-in while maintaining the program's integrity. Which approach best achieves this?

   • AEngage marketing leadership in a pilot program to refine the controls, demonstrating how they can protect sensitive campaign data without disrupting workflows.
   • BExempt marketing from the data classification requirements to avoid friction.
   • CImplement the controls globally and provide a helpdesk for any issues.
   • DSend a memo explaining the program's compliance requirements and the consequences of non-compliance.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary goal of socializing a security program with stakeholders?

   • ATo satisfy regulatory requirements for stakeholder communication
   • BTo inform stakeholders of security policies after they have been finalized
   • CTo gain buy-in and ensure ongoing support for the program
   • DTo demonstrate technical expertise to the security team
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security manager wants to report to senior leadership on the effectiveness of the company's vulnerability management program. Which metric would be most meaningful to senior leadership?

   • AAverage time to remediate critical vulnerabilities
   • BNumber of vulnerabilities discovered each month
   • CPercentage of IT budget spent on security
   • DTotal number of security tools in use
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial services firm is rolling out a new data loss prevention (DLP) program. The security team has encountered resistance from the sales department, which fears the DLP controls will slow down their ability to share documents with clients. What is the most effective way to socialize the program and gain buy-in from the sales team?

   • ASend a company-wide email explaining the DLP program and its compliance requirements.
   • BImplement the DLP controls first and address concerns after the rollout is complete.
   • CAsk the sales team to submit a list of all documents they share with clients for a security review.
   • DHold a targeted workshop with sales leadership to demonstrate how DLP can protect client data while minimizing workflow disruption.
   Reveal Solution Discussion Select an answer first