A security awareness program has been running for two years. The click rate on phishing simulations has plateaued at 8%, and employee feedback indicates that the training is becoming repetitive. The CISO wants to improve the program without increasing the budget. What should the security team do?

Increase the frequency of the same simulations to reinforce the message.

Stop running simulations and focus only on compliance training.

Analyze the types of simulations that employees fall for and introduce new, more realistic scenarios based on current threats.

Purchase a new commercial training platform with more features.

Why is it important to tailor security awareness training to different employee roles?

To comply with legal requirements that mandate role-specific training

To ensure that training content is relevant to the specific risks each role faces

To make training more difficult for employees in technical roles

To reduce the total time employees spend in training

A company with a diverse workforce, including many non-technical employees, is designing a security awareness training program. The training team wants to ensure that the content is accessible and effective for all employees. Which approach best meets this need?

Use a mix of formats, including short videos, interactive scenarios, and simple language, with optional deep-dive modules.

Require all employees to attend a live, instructor-led session that uses technical jargon to ensure depth.

Deliver a single, comprehensive text-based manual that covers all topics in detail.

Provide the same training to all employees without any customization to ensure consistency.

A company has been running the same security awareness training for two years. Phishing simulation click rates have plateaued, and employees report that the training feels repetitive. Which approach best supports continuous improvement of the program?

Cancel the training program because it is no longer effective.

Analyze simulation results by department and update training content to address specific weaknesses.

Replace the training with a longer, more detailed annual course.

Increase the frequency of phishing simulations to keep employees on alert.

A company's security awareness training is delivered as a mandatory annual online course. The training completion rate is high, but the security team suspects that employees are not retaining the information. What should the team do to improve retention?

Make the annual course longer and more detailed.

Remove the annual course and rely on occasional email reminders.

Increase the passing score on the annual course exam to 100%.

Add short, frequent reinforcement quizzes or micro-learning modules throughout the year.

GIAC Security Leadership

Domain 5Objective 3

Managing Security Awareness GSLC Practice Questions (Page 2)

Part of the Business and Vendor Management domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 6–10

6expert · hard
A security awareness program has been running for two years. The click rate on phishing simulations has plateaued at 8%, and employee feedback indicates that the training is becoming repetitive. The CISO wants to improve the program without increasing the budget. What should the security team do?
Select an answer first
7foundation · easy
Why is it important to tailor security awareness training to different employee roles?
Select an answer first
8expert · hard
A company with a diverse workforce, including many non-technical employees, is designing a security awareness training program. The training team wants to ensure that the content is accessible and effective for all employees. Which approach best meets this need?
Select an answer first
9application · medium
A company has been running the same security awareness training for two years. Phishing simulation click rates have plateaued, and employees report that the training feels repetitive. Which approach best supports continuous improvement of the program?
Select an answer first
10application · medium
A company's security awareness training is delivered as a mandatory annual online course. The training completion rate is high, but the security team suspects that employees are not retaining the information. What should the team do to improve retention?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.