GIAC Strategic Planning, Policy, and Leadership (GSTRT) Sample Questions:

1. Your organization is preparing to roll out a new Bring Your Own Device (BYOD) policy to allow employees to use personal devices for work purposes. The IT team is concerned about the potential security risks associated with this policy. How would you address these concerns while ensuring the policy aligns with business objectives?
Response:

A) Collaborate with the IT team to establish clear security guidelines, including device encryption, regular security updates, and remote wiping in case of loss, and communicate these requirements in the policy
B) Restrict the use of personal devices and require all employees to use company-provided devices
C) Delay the policy implementation until the IT team has fully assessed all risks
D) Implement the policy without addressing security concerns, as BYOD aligns with business goals

2. When assessing the performance of a security program, why is it important to involve cross-functional teams?
Response:

A) To delay the assessment process
B) To limit input from non-technical departments
C) To shift responsibility away from the security team
D) To gather diverse perspectives and ensure the program addresses the needs of different departments

3. Your organization is developing a new security program to address both internal threats and compliance requirements. However, after initial development, you discover that the program does not adequately address insider threats. How would you revise the program to account for this gap?
Response:

A) Update the program to include measures such as employee background checks, access control monitoring, and security awareness training focused on detecting and preventing insider threats
B) Implement a separate program to handle insider threats without revising the current security program
C) Ignore the insider threat issue, as it hasn't been a problem in the past
D) Eliminate all employee access to sensitive systems

4. When assessing the maturity of a security program, which of the following tools or frameworks is often used?
Response:

A) ISO 27001
B) SQL database
C) Adobe Photoshop
D) Microsoft Excel

5. You are tasked with creating a data breach notification policy to ensure compliance with regulations like GDPR and CCPA. The policy must outline how the organization responds to breaches and informs affected individuals. What elements would you prioritize in the policy to meet regulatory requirements?
Response:

A) Include a clear process for timely breach notification, define the roles responsible for issuing notifications, and ensure the policy aligns with legal timeframes for informing affected parties
B) Notify affected parties only if the breach involves more than 10,000 individuals
C) Issue internal communications only and handle all notifications on an ad hoc basis
D) Delay notification of data breaches until legal counsel reviews every incident

Solutions: