A government agency has a policy that all privileged access requests must be approved by the information owner. The security team notices that some approvals are being granted without proper verification. What is the most effective way to enforce the policy?

Allow information owners to delegate approval authority to their assistants to speed up the process.

Send a reminder email to information owners about the approval requirement.

Implement an automated access request workflow that routes requests to the information owner and logs all approvals.

Conduct a quarterly audit of approved access requests and discipline violators.

Which sequence correctly represents the typical stages of a security policy lifecycle?

Development, approval, publication, enforcement, review, retirement

Publication, development, review, approval, enforcement, retirement

Review, development, retirement, approval, publication, enforcement

Approval, development, enforcement, publication, retirement, review

A global company is rolling out a new security policy. The policy is mandatory, but employees in different regions have varying levels of awareness and cultural attitudes toward security. The security manager must ensure consistent implementation. What is the best approach?

Use a single global communication campaign with the same message everywhere

Tailor communication and training to regional needs while maintaining the policy's core requirements

Let each region decide how to implement the policy

Enforce the policy through technical controls only, without communication

A security manager is responsible for a set of 20 security policies. Some policies are critical to compliance, while others are operational. The manager has limited resources for policy reviews. What is the best way to prioritize reviews?

Delegate reviews to policy owners without central coordination

Prioritize reviews based on risk, regulatory requirements, and recent changes

Review all policies on the same annual schedule regardless of risk

Review policies only when an incident occurs

What is a key element of enforcing a security policy?

Keeping the policy confidential

Making the policy optional for senior staff

Allowing each manager to interpret the policy freely

Defining consequences for non-compliance

GIAC Security Leadership

Domain 1Objective 1

Managing Security Policy GSLC Practice Questions (Page 4)

Part of the Security Management and Governance domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 16–20

16application · medium
A government agency has a policy that all privileged access requests must be approved by the information owner. The security team notices that some approvals are being granted without proper verification. What is the most effective way to enforce the policy?
Select an answer first
17foundation · easy
Which sequence correctly represents the typical stages of a security policy lifecycle?
Select an answer first
18expert · hard
A global company is rolling out a new security policy. The policy is mandatory, but employees in different regions have varying levels of awareness and cultural attitudes toward security. The security manager must ensure consistent implementation. What is the best approach?
Select an answer first
19expert · hard
A security manager is responsible for a set of 20 security policies. Some policies are critical to compliance, while others are operational. The manager has limited resources for policy reviews. What is the best way to prioritize reviews?
Select an answer first
20foundation · easy
What is a key element of enforcing a security policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.