A legacy security policy has been in place for over a decade. It mandates outdated encryption standards and does not cover modern cloud services. The organization is undergoing a digital transformation and the policy is hindering progress. The security manager must decide how to handle the policy. Which approach is most appropriate?

Retire the policy immediately and operate without a formal policy until a new one is drafted

Revise the policy through a formal review process, updating outdated sections and adding cloud guidance

Create a new policy and leave the old one in place to avoid a gap

Keep the policy unchanged to avoid disruption during the digital transformation

What is the final step in the security policy development process before the policy is officially issued?

Obtaining formal approval from authorized management

Archiving the previous version of the policy

Conducting a security awareness training session

Distributing the policy to all employees

A university is developing a data classification policy. Faculty, IT, and the legal department have conflicting views on what constitutes 'sensitive' data. What is the best way to resolve these conflicts during policy development?

Ask the IT department to decide because they will implement the technical controls.

Facilitate a workshop with all stakeholders to define data categories and gain consensus before drafting the policy.

Adopt the legal department's definition because compliance is the top priority.

Draft the policy with broad definitions and let each department interpret them as needed.

Why is it important to provide security awareness training after a new policy is published?

To replace the need for written policy documentation

To help employees understand their responsibilities and how to comply

To eliminate the need for ongoing policy reviews

To satisfy legal requirements in all jurisdictions

A company's policy requires that all external drives be scanned for malware before use. The security team wants to measure compliance. What is the most reliable indicator?

A poster reminding employees to scan drives.

The number of malware infections detected on external drives.

Employee attestations that they always scan external drives.

Logs from the endpoint protection software showing scans performed on external drives.

GIAC Security Leadership

Domain 1Objective 1

Managing Security Policy GSLC Practice Questions (Page 2)

Part of the Security Management and Governance domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 6–10

6expert · hard
A legacy security policy has been in place for over a decade. It mandates outdated encryption standards and does not cover modern cloud services. The organization is undergoing a digital transformation and the policy is hindering progress. The security manager must decide how to handle the policy. Which approach is most appropriate?
Select an answer first
7foundation · easy
What is the final step in the security policy development process before the policy is officially issued?
Select an answer first
8application · medium
A university is developing a data classification policy. Faculty, IT, and the legal department have conflicting views on what constitutes 'sensitive' data. What is the best way to resolve these conflicts during policy development?
Select an answer first
9foundation · easy
Why is it important to provide security awareness training after a new policy is published?
Select an answer first
10application · medium
A company's policy requires that all external drives be scanned for malware before use. The security team wants to measure compliance. What is the most reliable indicator?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.