During the development of a new security policy, which group should provide input to ensure the policy is practical and aligned with business operations?

Stakeholders from affected business units and IT

Only the chief information security officer (CISO)

A security manager is responsible for maintaining the organization's security policies. The policies were last reviewed two years ago. The manager wants to establish a sustainable review process. What is the best approach?

Review policies only when a major incident occurs

Review all policies at the same time every year

Set a regular review cycle, such as annually, and trigger reviews on significant changes

Assign each policy owner to review their policy whenever they have time

A retail company has a policy requiring all laptops to be encrypted. The security manager wants to verify that employees are actually complying. Which method provides the most reliable evidence of compliance?

Run a network scan to detect unencrypted laptops

Use endpoint management tools to query encryption status on all laptops

Ask department managers to confirm their teams follow the policy

Review a sample of laptops during annual audits

A hospital network has a policy requiring all laptops to be encrypted. The security team wants to verify compliance without disrupting clinical staff. Which method is most appropriate?

Use an endpoint management tool to remotely query each laptop's encryption status and generate a compliance report.

Require all staff to bring their laptops to IT for a manual check during the next month.

Ask department managers to self-certify that their staff's laptops are encrypted.

Conduct a physical audit of a random sample of laptops each quarter.

Which approach is most effective for communicating a new security policy to employees?

Verbally mentioning the policy during a team meeting

Multiple channels, including email, training, and intranet posting

Posting the policy only on the internal wiki

A single email to all employees

GIAC Security Leadership

Domain 1Objective 1

Managing Security Policy GSLC Practice Questions (Page 1)

Part of the Security Management and Governance domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 1–5

1foundation · easy
During the development of a new security policy, which group should provide input to ensure the policy is practical and aligned with business operations?
Select an answer first
2application · medium
A security manager is responsible for maintaining the organization's security policies. The policies were last reviewed two years ago. The manager wants to establish a sustainable review process. What is the best approach?
Select an answer first
3application · medium
A retail company has a policy requiring all laptops to be encrypted. The security manager wants to verify that employees are actually complying. Which method provides the most reliable evidence of compliance?
Select an answer first
4application · medium
A hospital network has a policy requiring all laptops to be encrypted. The security team wants to verify compliance without disrupting clinical staff. Which method is most appropriate?
Select an answer first
5foundation · easy
Which approach is most effective for communicating a new security policy to employees?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.