A security team is evaluating a new awareness training platform. The platform offers gamified modules, phishing simulations, and detailed metrics. The team has a limited budget and wants to maximize engagement and learning. What should they consider before purchasing?

Whether the platform's content can be customized to address the company's specific risks and whether the metrics align with the program's goals.

Whether the platform can be deployed without any IT involvement.

Whether the platform has the most gamification features available.

Whether the platform is the cheapest option on the market.

A small company is creating its first security awareness program. The budget is limited, and the CEO wants to see a quick return on investment. Which component should be included first to establish a foundation for the program?

A phishing simulation program that runs quarterly.

A mandatory annual training module covering basic security topics.

A monthly newsletter with security tips and recent threat news.

A security awareness poster campaign in common areas.

A security team is designing a phishing simulation for a company that has a high number of remote workers. The team wants to test employees' ability to recognize phishing emails that could lead to credential theft. Which simulation design would be most effective while minimizing the risk of disrupting business operations?

Send a realistic phishing email to a small sample of employees during off-peak hours and track who clicks.

Send a generic phishing email to all employees and track who clicks, without any follow-up training.

Send a highly convincing phishing email to all employees and immediately lock the accounts of those who click.

Conduct a vishing (phone) simulation to all employees during business hours to test their response.

A company is creating a security awareness program for the first time. The security team wants to ensure that the program is sustainable and has leadership support. What should they do first?

Purchase a training platform and deploy it immediately.

Create a detailed policy document and distribute it to all employees.

Run a phishing simulation to see how employees respond.

Develop a business case that links the program to reducing security incidents and obtain executive sponsorship.

A company has a diverse workforce, including remote workers and employees with varying technical skills. The security team wants to deliver security awareness training that is engaging and effective for all employees. Which delivery method should they choose?

A single comprehensive in-person training session held at headquarters.

A long PDF document with all security policies and procedures.

A mandatory video that employees must watch in one sitting.

A mix of short interactive online modules and live virtual workshops.

GIAC Security Leadership

Domain 5Objective 3

Managing Security Awareness GSLC Practice Questions (Page 8)

Part of the Business and Vendor Management domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

6concepts

Questions 36–40

36expert · hard
A security team is evaluating a new awareness training platform. The platform offers gamified modules, phishing simulations, and detailed metrics. The team has a limited budget and wants to maximize engagement and learning. What should they consider before purchasing?
Select an answer first
37application · medium
A small company is creating its first security awareness program. The budget is limited, and the CEO wants to see a quick return on investment. Which component should be included first to establish a foundation for the program?
Select an answer first
38expert · hard
A security team is designing a phishing simulation for a company that has a high number of remote workers. The team wants to test employees' ability to recognize phishing emails that could lead to credential theft. Which simulation design would be most effective while minimizing the risk of disrupting business operations?
Select an answer first
39application · medium
A company is creating a security awareness program for the first time. The security team wants to ensure that the program is sustainable and has leadership support. What should they do first?
Select an answer first
40application · medium
A company has a diverse workforce, including remote workers and employees with varying technical skills. The security team wants to deliver security awareness training that is engaging and effective for all employees. Which delivery method should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.