Security Program Development GSTRT Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is an example of a security metric that measures program effectiveness?

   • ATotal amount of security budget spent
   • BPercentage of systems with up-to-date antivirus signatures
   • CNumber of security policies published
   • DNumber of security vendors used by the organization
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A global company is developing a security roadmap. The company must comply with GDPR for its European customers and is expanding into a new market in Asia. The CISO has limited budget and must balance compliance requirements with business growth. Which approach best aligns the roadmap with these competing priorities?

   • APrioritize GDPR compliance projects because they are legally required, and defer all other initiatives until compliance is achieved.
   • BImplement all GDPR and Asian market initiatives simultaneously without prioritization.
   • CFocus solely on the Asian market expansion and address GDPR compliance later, since the company is already operating in Europe.
   • DBalance the roadmap by scheduling GDPR compliance projects in parallel with initiatives that support the Asian market expansion, while ensuring compliance milestones are met.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A mid-sized company is creating a security roadmap. The company has limited budget and staff. The CISO has identified three projects: patching critical vulnerabilities, implementing a data loss prevention (DLP) solution, and building a security metrics dashboard. Which project should be prioritized first?

   • ABuilding a security metrics dashboard
   • BAll three projects in parallel
   • CPatching critical vulnerabilities
   • DImplementing a DLP solution
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A regional bank is developing its first formal security program. The board has approved a modest budget and wants to see progress within 12 months. The CISO has identified several initiatives: deploying a SIEM, implementing MFA for all remote access, creating an incident response plan, and starting a security awareness campaign. Which approach best aligns the roadmap with the bank's priorities?

   • ADefer the awareness campaign and SIEM until after the incident response plan is fully tested.
   • BImplement all four initiatives in parallel to maximize coverage in the first year.
   • CPhase the initiatives, starting with MFA and the incident response plan, then the SIEM, and finally the awareness campaign.
   • DFocus solely on the SIEM because it provides the most visibility for the board.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A software development company has implemented a secure coding training program for its developers. The security manager wants to measure the program's effectiveness. Which metric would be most meaningful?

   • ANumber of developers who completed the training.
   • BPercentage of developers who reported satisfaction with the training.
   • CChange in the number of security vulnerabilities found in code reviews before and after training.
   • DNumber of training sessions conducted per year.
   Reveal Solution Discussion Select an answer first