A company is updating its security awareness program. The CEO wants to ensure that the program aligns with the company's risk tolerance and business goals. What should the security team do first?

Copy the awareness program from a similar company in the same industry.

Conduct a risk assessment to identify the top threats and align the program's content and metrics with those risks.

Purchase a commercial awareness training platform with the most features.

Focus only on compliance requirements to avoid penalties.

Which approach is considered a best practice for delivering security awareness training to employees?

Delivering the same generic training to all employees regardless of role

Conducting training only when a security incident occurs

Providing a lengthy annual presentation with no interaction

Using short, interactive, and frequent training modules

A security manager wants to demonstrate the value of the security awareness program to the board. Which metric would be most compelling to show a reduction in risk?

The percentage of employees who report phishing emails to the security team.

The average score on the annual security knowledge assessment.

The number of security awareness posters displayed in the office.

The number of training sessions conducted during the year.

A small company is starting a security awareness program from scratch. The CEO wants to ensure that employees understand the importance of security and know how to report incidents. The company has limited resources. What should the program include first?

A comprehensive annual training course with advanced topics.

A brief onboarding session covering key policies, common threats, and the incident reporting process.

A monthly newsletter with security news and tips.

A phishing simulation immediately after hiring.

An organization is updating its incident response plan and wants to integrate security awareness to improve reporting. Which practice would most effectively encourage employees to report incidents promptly?

Publish a clear reporting procedure that includes a dedicated email address and a 24/7 hotline.

Wait for employees to report incidents only if they are certain it is a security incident.

Require employees to report incidents only to their direct supervisor.

Include a reporting reminder in the annual training but do not provide specific instructions.

GIAC Security Leadership

Domain 5Objective 3

Managing Security Awareness GSLC Practice Questions (Page 4)

Part of the Business and Vendor Management domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 16–20

16application · medium
A company is updating its security awareness program. The CEO wants to ensure that the program aligns with the company's risk tolerance and business goals. What should the security team do first?
Select an answer first
17foundation · easy
Which approach is considered a best practice for delivering security awareness training to employees?
Select an answer first
18application · medium
A security manager wants to demonstrate the value of the security awareness program to the board. Which metric would be most compelling to show a reduction in risk?
Select an answer first
19application · medium
A small company is starting a security awareness program from scratch. The CEO wants to ensure that employees understand the importance of security and know how to report incidents. The company has limited resources. What should the program include first?
Select an answer first
20application · medium
An organization is updating its incident response plan and wants to integrate security awareness to improve reporting. Which practice would most effectively encourage employees to report incidents promptly?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.