Free GSTRT Practice Questions

Question 1

An acquisition closes on Friday, and consolidated billing must begin on Monday. The acquired company has unexplained privileged accounts and has not demonstrated its recovery capability. The integration policy prohibits unrestricted network or identity trust until these issues are assessed and the required controls are verified. A controlled file-exchange service can support billing without establishing that trust.

What should the security leader recommend for Monday?

Accepted Answer

Use the controlled exchange while designated owners verify privileged access and recovery capability.

Answer

Establish identity trust now and resolve outstanding issues under intensive monitoring.

Answer

Defer all billing integration until every acquired application has completed a comprehensive security assessment.

Answer

Obtain the seller's contractual assurance of compliance, then establish the planned network trust.

Question 2

An engineer has led six successful incident exercises and adapts them well when the facts change. After an executive publicly challenged the last exercise, the engineer asks the CISO to script the next session and approve every decision. A review finds no gap in the engineer's exercise-design skills. The CISO wants the engineer to regain confidence while continuing to lead. Which response fits that need?

Accepted Answer

Discuss the concern and offer a rehearsal; leave exercise design and leadership with the engineer.

Answer

Supply a full session script and require approval before the engineer shares decisions with participants.

Answer

Have another leader run the next exercise while the engineer observes the handling of executive questions.

Answer

Let the engineer lead without additional discussion and evaluate the results afterward.

Question 3

May's performance target is to remediate at least 90% of findings by their May deadlines. At May 31, 100 findings due that month had verified remediation: 95 on time and five late. Another 20 May-due findings remained open. Separately, 15 findings with deadlines before May were still open. Which statement belongs in the May performance report?

Accepted Answer

79.2%; the target was missed, with 95 of 120 May-due findings remediated on time.

Answer

95.0%; target met, using verified closures as the denominator.

Answer

70.4%; the target was missed after adding the 15 earlier overdue findings to the reporting cohort.

Answer

83.3%; the target was missed because 100 of the 120 findings due in May were closed.

Question 4

A pilot assistant reads service tickets and drafts routing recommendations for staff. Its integration account can also delete tickets and change customer contact details, although neither action is part of the approved use. Testing shows that an ordinary ambiguous request can trigger those functions. The team proposes adding a warning to the assistant's instructions. What design change most directly addresses the failure?

Accepted Answer

Remove deletion and contact-edit tools and revoke the integration account's permissions for both actions.

Answer

Add prohibited-action examples to the assistant's instructions and require explanations for its recommendations.

Answer

Require user confirmation before deletion while retaining the ability to update customer details during ticket handling.

Answer

Log ticket changes and alert an administrator when the assistant invokes functions unrelated to routing.

Question 5

At a water-treatment facility, a compromised remote-access session is issuing unauthorized process commands. On-site operators confirm that they can maintain safe treatment using the approved local control mode. The incident plan authorizes the on-call security lead to revoke remote access while operators retain local control; a full plant shutdown requires the plant director's authorization. The unauthorized commands are continuing.

What should the security lead do now?

Accepted Answer

Revoke remote access while operators maintain the approved local control mode.

Answer

Disconnect the entire control network and stop the treatment process immediately.

Answer

Keep the session active while operators collect a complete history of commands.

Answer

Ask the plant director to authorize remote-access revocation before acting.

Question 6

An assessment places a security program at NIST CSF 2.0 Tier 3, Repeatable: risk practices are formalized, consistently performed, and reviewed across the enterprise. Testing nevertheless finds that some privileged remote accounts lack the multifactor authentication required by the approved Target Profile. A sponsor argues that the Tier 3 result makes further access-control investment discretionary. What does the evidence establish?

Accepted Answer

The access-control shortfall remains an outcome gap despite repeatable risk management practices.

Answer

The unfulfilled outcome invalidates the Tier 3 rating.

Answer

The completed Tier review authorizes deferring Target Profile gaps until its next scheduled cycle.

Answer

The Tier result establishes satisfactory implementation, while the Target Profile describes optional improvements.

Question 7

At Friday's handover, an analyst reported a vendor-access review complete. Three owner responses were still pending in the tracker, so operations left those follow-ups out of the next week's plan. The affected accounts were already disabled. How should the manager open a situation-behavior-impact feedback conversation while inviting the analyst's perspective?

Accepted Answer

Three responses were pending at Friday's handover; reporting completion caused follow-ups to be dropped. What happened?

Answer

Help me understand why you considered the review complete with three owner responses still pending.

Answer

Would further training on the tracker prevent you from reporting completion before the required responses arrive?

Answer

Can you explain the omission before I decide whether it warrants a formal disciplinary review?

Question 8

An internal reviewer finds a production appliance outside the approved configuration baseline. The organization's baseline permits an exception route, and this appliance has a current exception approved by the designated risk owner through that route. Its scope, justification, compensating controls, remediation plan, and expiry are recorded. The controls are working, and the deployment has not changed. What should the reviewer report?

Accepted Answer

An approved baseline exception that remains subject to control monitoring and expiry.

Answer

Full baseline conformance because an authorized risk owner has accepted the departure from the required configuration.

Answer

An unauthorized deviation requiring service suspension until every baseline check passes.

Answer

A new acceptance decision for the security director, because an assurance finding supersedes the existing risk approval.

Question 9

An order-fulfilment process must resume no later than six hours after an outage. After its IT systems are restored, reconciliation and operational restart take two additional hours. The business also permits the loss of no more than ten minutes of transactions.

Which recovery design meets both requirements?

Accepted Answer

Restore IT in 3.5 hours using data from 8 minutes before the outage.

Answer

Restore IT in 3 hours using data from 20 minutes before the outage.

Answer

Restore IT in 5 hours using data from 5 minutes before the outage.

Answer

Restore IT in 4.5 hours using data from 15 minutes before the outage.

Question 10

An organization's access policy requires authentication appropriate to risk. A cross-platform rule must now mandate an approved multifactor method for privileged remote sessions. Platform teams will write separate setup instructions, and approved methods may change more often than the access policy. Under the policy-standard-procedure-guideline hierarchy, where should the mandatory implementation rule sit?

Accepted Answer

In a standard that makes the authentication requirement consistent across the affected platforms.

Answer

In a procedure that gives each platform team an ordered set of configuration steps.

Answer

In the access policy itself, alongside the enduring statement of management's security intent.

Answer

In a guideline that gives administrators a common approach while permitting local alternatives.

Free GSTRT Practice Questions

Domain 1: Effective Management & Comms

Question 1

Domain 2: Leadership & Change

Question 2

Domain 3: Policy Development

Question 3

Question 4

Domain 4: Policy Management

Question 5

Domain 5: Security Program Analysis

Question 6

Domain 6: Security Program Development

Question 7

Domain 7: Understanding the Business

Question 8

Question 9

Domain 8: Understanding the Threats

Question 10

That's 10 of 1,030