Security Program Development GSTRT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A logistics company is developing a three-year security roadmap. The company's top priority is protecting customer data, followed by uptime of its tracking systems. The security team has proposed three projects: encrypting customer databases, implementing a high-availability architecture for tracking systems, and deploying a new firewall. Which project should be scheduled first?

   • ANew firewall deployment
   • BHigh-availability architecture for tracking systems
   • CEncrypting customer databases
   • DAll three projects simultaneously
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of dividing a security roadmap into phases?

   • ATo satisfy regulatory audit requirements for project management
   • BTo ensure that every security control is implemented before any business initiative proceeds
   • CTo deliver security improvements incrementally while managing dependencies and resource constraints
   • DTo avoid the need for ongoing risk assessments after the initial phase
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   A security manager is developing a multi-year security roadmap. Which approach best ensures the roadmap aligns with organizational goals and priorities?

   • AGrouping all initiatives into a single phase to achieve rapid improvement
   • BStarting with the most technically advanced controls and working backward
   • CPrioritizing initiatives that directly support the organization's strategic objectives and risk appetite
   • DSequencing initiatives based on the availability of security staff and budget
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A technology startup is introducing a new security program that includes multi-factor authentication (MFA) for all employees. The engineering team is concerned that MFA will slow down their development workflows. What is the best way to socialize the program to gain engineering's support?

   • AImplement MFA without prior communication and address concerns after rollout.
   • BExplain the security benefits of MFA and how it protects the company's intellectual property and customer data.
   • COffer to exempt the engineering team from MFA to avoid disrupting their workflows.
   • DProvide a detailed technical specification of the MFA solution to the engineering team.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A financial services firm is considering investing in a new security operations center (SOC). The CISO must present a business case to the board. Which element is most important to include to gain board approval?

   • AA risk analysis showing the likelihood and financial impact of a major cyber incident
   • BA timeline for hiring and training SOC analysts
   • CA comparison of SOC staffing models (in-house vs. outsourced)
   • DA list of security tools the SOC will use
   Reveal Solution Discussion Select an answer first