GIAC (SANS)GIAC Security Leadership
The GIAC Security Leadership (GSLC) certification validates your ability to lead security teams by blending practical technical controls with strategic governance. It is designed for information security managers and security professionals with leadership responsibilities who must protect, detect, and respond to security issues across the entire security lifecycle. Earning GSLC demonstrates that you can build security programs that meet business needs, manage security operations and teams, and oversee security projects from start to finish.
1002 practice questions · Updated 2026-07-30
6Domains
19Objectives
184Concepts
1002Questions
GSLC Curriculum
Every domain, objective, and concept the GSLC exam measures.
- Policy Lifecycle Management
- Policy Development Process
- Policy Implementation and Communication
- Policy Enforcement and Compliance
- Policy Review and Maintenance
- Policy Governance and Oversight
- Program Structure Definition
- Governance Framework Alignment
- Roles and Responsibilities
- Program Lifecycle Management
- Resource Allocation
- Communication and Reporting
- Integration with Business Processes
- Compliance and Regulatory Considerations
- Performance Metrics and KPIs
- Continuous Improvement Mechanisms
- Risk Management Fundamentals
- Risk Assessment Process
- Risk Treatment Strategies
- Risk Communication and Monitoring
- Security Frameworks Overview
- Framework Implementation
- Governance and Compliance
- System Security Fundamentals
- Security Baselines and Hardening
- Patch and Vulnerability Management
- Access Control and Identity Management
- System Monitoring and Auditing
- Incident Response and Recovery
- Compliance and Policy Management
- Secure System Lifecycle Management
- Network Security Fundamentals
- Network Threats and Vulnerabilities
- Network Security Controls
- Network Segmentation and Isolation
- Secure Network Architecture
- Network Monitoring and Analysis
- Incident Response for Network Security
- Network Security Policies and Procedures
- Compliance and Regulatory Requirements
- Emerging Network Security Technologies
- Cloud Security Fundamentals
- Cloud Risk Assessment
- Cloud Security Controls
- Cloud Compliance and Legal Issues
- Cloud Security Architecture
- Cloud Incident Response
- Cloud Vendor Management
- Application Security Fundamentals
- Secure Software Development Lifecycle (SSDLC)
- Threat Modeling
- Common Application Vulnerabilities
- Application Security Testing
- Security Requirements and Design
- Secure Coding Practices
- Application Security Controls
- Application Security Governance
- Vulnerability Management for Applications
- Application Security Metrics and Reporting
- Application Security in DevOps and Cloud
- Third-Party and Open Source Component Security
- Incident Response for Application Security
- Application Security Awareness and Training
- AI Fundamentals
- AI Risk Landscape
- AI Governance Frameworks
- AI System Lifecycle Management
- AI Data Management
- AI Model Security
- AI Ethics and Bias
- AI Assurance and Auditing
- AI Incident Response
- AI Vendor and Third-Party Management
- AI and Organizational Strategy
- AI Skills and Training
- SOC Purpose and Functions
- SOC Staffing and Roles
- SOC Processes and Procedures
- SOC Technologies and Tools
- SOC Metrics and Performance
- SOC Maturity and Improvement
- Network Monitoring Fundamentals
- Key Network Monitoring Metrics
- Monitoring Tools and Technologies
- Security Monitoring vs. Performance Monitoring
- Interpreting Monitoring Data
- Alerting and Incident Response
- Compliance and Reporting
- Incident Response Lifecycle
- Incident Response Team Roles
- Incident Classification and Triage
- Incident Detection and Reporting
- Containment Strategies
- Eradication and Recovery
- Evidence Handling and Chain of Custody
- Communication and Coordination
- Post-Incident Review and Lessons Learned
- Business Continuity Planning Fundamentals
- Business Impact Analysis
- Continuity Strategies and Recovery Objectives
- Continuity Plan Development and Implementation
- Testing and Exercising Continuity Plans
- Integration of Incident Response and Business Continuity
- Vulnerability Management Lifecycle
- Vulnerability Identification
- Vulnerability Assessment
- Risk-Based Prioritization
- Remediation Strategies
- Verification and Reporting
- Integration with Incident Response
- Cryptography Fundamentals
- Symmetric vs. Asymmetric Encryption
- Key Management
- Hashing and Digital Signatures
- Public Key Infrastructure (PKI)
- Cryptographic Attacks
- Cryptography in Compliance
- Managerial Oversight of Cryptography
- Encryption Fundamentals
- Key Management
- Encryption in Transit
- Encryption at Rest
- Privacy Regulations and Compliance
- Data Classification and Handling
- Privacy by Design
- Incident Response for Encryption and Privacy
- Negotiation Fundamentals
- Negotiation Preparation
- Negotiation Strategies and Tactics
- Negotiation Communication Skills
- Vendor Selection Process
- Vendor Contracting
- Vendor Relationship Management
- Vendor Risk Management
- Vendor Performance Evaluation
- Vendor Termination and Transition
- Project Management Fundamentals
- Project Life Cycle
- Project Initiation
- Project Planning
- Project Execution
- Project Monitoring and Controlling
- Project Closing
- Project Scope Management
- Project Schedule Management
- Project Cost Management
- Project Quality Management
- Project Resource Management
- Project Communication Management
- Project Risk Management
- Project Procurement Management
- Project Stakeholder Management
- Project Governance
- Project Management Methodologies
- Project Management Tools and Techniques
- Project Leadership and Team Management
- Project Success Criteria and Metrics
- Project Documentation and Reporting
- Project Change Management
- Project Integration Management
- Security Awareness Program Fundamentals
- Security Awareness Training Delivery
- Measuring Security Awareness Effectiveness
- Phishing Simulations and Social Engineering Tests
- Incident Reporting and Response in Awareness Context
- Continuous Improvement of Awareness Programs
- Network Fundamentals
- Network Topologies
- OSI and TCP/IP Models
- IP Addressing and Subnetting
- Network Protocols
- Network Devices
- LAN, WAN, and MAN
- Wireless Networking
- Network Security Basics
- Network Management and Monitoring
- Network Security Architecture Fundamentals
- Network Segmentation and Zoning
- Secure Network Design Patterns
- Network Access Control (NAC)
- Firewall and IDS/IPS Architecture
- VPN and Remote Access Security
- Network Monitoring and Logging
- Resilience and Redundancy in Network Architecture
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GSLC, so none is invented.