In a critical infrastructure organization, which of the following is a primary security management responsibility assigned to senior managers?

Installing security patches on production servers

Approving the organization's security policy and ensuring resources are available for its implementation

Performing daily log reviews and incident triage

Configuring firewall rules and intrusion detection signatures

An organization is updating its security policy. The policy must be approved by the senior manager, but the CISO has identified a critical vulnerability that requires an immediate policy change. The senior manager is unavailable for two weeks. What is the best course of action?

Have the CISO approve the policy change on behalf of the senior manager

Wait for the senior manager to return and approve the policy change

Issue an emergency policy change without formal approval

Implement an interim technical control to mitigate the vulnerability while the policy change is pending

A company's security policy is due for review. The policy was written five years ago and has not been updated. The company has since adopted cloud services and mobile devices. What is the best course of action?

Revise the policy to address current technologies and risks, and obtain senior management approval

Have the IT department update the policy without senior management approval

Keep the policy unchanged to maintain consistency

Replace the policy with a set of technical standards

For a low-risk or low-impact facility, which of the following security management controls is most likely to be required?

Biometric authentication for all personnel and visitors

A documented security policy and basic access control measures

24/7 video surveillance with motion detection and analytics

A full-time armed guard force at every entrance

A government agency is developing a security policy for its new building. The policy must be approved by the agency head. What is the primary purpose of obtaining this approval?

To ensure the policy has the authority of senior management

To make the policy legally binding in court

To satisfy the requirements of the security software vendor

To allow employees to ignore the policy if they disagree

GIAC Critical Infrastructure Protection (GCIP)

Domain 1Objective 3

Security Management Controls GCIP Practice Questions (Page 7)

Part of the Foundations and Governance domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 6–10 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

3concepts

Questions 31–35

31foundation · easy
In a critical infrastructure organization, which of the following is a primary security management responsibility assigned to senior managers?
Select an answer first
32expert · hard
An organization is updating its security policy. The policy must be approved by the senior manager, but the CISO has identified a critical vulnerability that requires an immediate policy change. The senior manager is unavailable for two weeks. What is the best course of action?
Select an answer first
33expert · hard
A company's security policy is due for review. The policy was written five years ago and has not been updated. The company has since adopted cloud services and mobile devices. What is the best course of action?
Select an answer first
34foundation · easy
For a low-risk or low-impact facility, which of the following security management controls is most likely to be required?
Select an answer first
35application · medium
A government agency is developing a security policy for its new building. The policy must be approved by the agency head. What is the primary purpose of obtaining this approval?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.