GIAC GSTRT 問題集

質問 1：
Your organization is preparing to roll out a new Bring Your Own Device (BYOD) policy to allow employees to use personal devices for work purposes. The IT team is concerned about the potential security risks associated with this policy. How would you address these concerns while ensuring the policy aligns with business objectives?
Response:
A. Implement the policy without addressing security concerns, as BYOD aligns with business goals
B. Collaborate with the IT team to establish clear security guidelines, including device encryption, regular security updates, and remote wiping in case of loss, and communicate these requirements in the policy
C. Delay the policy implementation until the IT team has fully assessed all risks
D. Restrict the use of personal devices and require all employees to use company-provided devices
正解：B

質問 2：
What is the primary purpose of aligning cybersecurity strategy with an organization's business vision and mission?
Response:
A. To prevent the cybersecurity program from receiving excessive funding
B. To ensure the cybersecurity strategy supports business goals and adds value to the organization
C. To ensure that the cybersecurity strategy operates independently of business objectives
D. To allow the security team to work autonomously from business stakeholders
正解：B

質問 3：
Why is it important for an organization to understand the motivations of different types of threat actors?
Response:
A. To hire threat actors as consultants
B. To tailor its cybersecurity strategy to address the specific threats posed by different actors, such as cybercriminals, nation-states, or hacktivists
C. To avoid implementing too many security controls
D. To limit investment in security technologies
正解：B

質問 4：
What is the purpose of conducting a security program gap analysis during development?
Response:
A. To identify vulnerabilities, risks, and areas where the current security program is not meeting the organization's security needs
B. To find areas where no improvement is needed
C. To eliminate the need for future security audits
D. To delay the implementation of new security measures
正解：A

質問 5：
How does benchmarking help in the analysis of a security program?
Response:
A. It eliminates the need for internal audits
B. It simplifies compliance with regulations
C. It compares the program against industry standards and peers to identify strengths and weaknesses
D. It reduces the workload of the security team
正解：C

質問 6：
Why is stakeholder buy-in critical during the development of a cybersecurity program?
Response:
A. Stakeholders help ensure that the program is aligned with business objectives and has the necessary support for successful implementation
B. Stakeholders can be ignored in favor of technical teams
C. Stakeholders do not play a role in cybersecurity
D. Stakeholders need to be involved to delay the project
正解：A

質問 7：
Which of the following is the best practice for maintaining the relevance of cybersecurity policies as technology evolves?
Response:
A. Assuming that current policies will always be relevant
B. Limiting policy updates to only when a security incident occurs
C. Conducting regular policy reviews and incorporating feedback from IT, legal, and compliance teams
D. Writing policies that are deliberately vague
正解：C