A global bank is updating its security policies. The board wants to ensure that policies support business agility, while regulators require strict compliance controls. The CISO proposes a policy governance framework. Which approach best balances these competing demands?

Establish a policy governance board with business and risk representatives that reviews policies against both strategic objectives and regulatory requirements.

Adopt a strict, compliance-only policy framework to satisfy regulators and avoid penalties.

Delegate policy decisions to individual business units to maximize agility.

Use a third-party framework verbatim to ensure best practices are followed.

A security manager is establishing a policy review process. Which practices should be included to ensure policies remain current? (Select all that apply.)

Document the review outcomes and changes

Schedule reviews at regular intervals, such as annually

Review policies only when an incident occurs

Trigger reviews when significant changes occur, such as new regulations

Involve stakeholders in the review process

What is the primary role of governance in managing security policies?

Purchasing security tools and software

Ensuring policies align with organizational objectives and risk tolerance

Monitoring network traffic for intrusions

Writing the technical details of each security control

Which body is typically responsible for approving security policies at the organizational level?

A governance committee or senior management

Individual system administrators

A company is consolidating multiple legacy security policies into a single, unified policy. What is the first step in this lifecycle activity?

Inventory all existing policies and identify overlaps, conflicts, and gaps.

Communicate the new policy to employees before drafting it.

Obtain board approval for the new policy before reviewing existing ones.

Draft the new unified policy and retire the old ones immediately.

GIAC Security Leadership

Domain 1Objective 1

Managing Security Policy GSLC Practice Questions (Page 5)

Part of the Security Management and Governance domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 21–25

21expert · hard
A global bank is updating its security policies. The board wants to ensure that policies support business agility, while regulators require strict compliance controls. The CISO proposes a policy governance framework. Which approach best balances these competing demands?
Select an answer first
22application · medium · select all that apply
A security manager is establishing a policy review process. Which practices should be included to ensure policies remain current? (Select all that apply.)
Select an answer first
23foundation · easy
What is the primary role of governance in managing security policies?
Select an answer first
24foundation · easy
Which body is typically responsible for approving security policies at the organizational level?
Select an answer first
25application · medium
A company is consolidating multiple legacy security policies into a single, unified policy. What is the first step in this lifecycle activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.