A university is developing a policy for research data handling. The policy must comply with federal regulations while also supporting academic freedom. Which approach best balances these needs?

Adopt a policy from another university

Base the policy on federal regulations only

Let the research faculty define the policy to preserve academic freedom

Write the policy with input from legal, research faculty, and IT

In the security policy lifecycle, what is the primary purpose of the retirement stage?

To archive all past versions of the policy for historical reference

To communicate the policy to new employees during onboarding

To re-approve the policy after a major revision

To formally remove a policy that is obsolete or has been replaced

A logistics company has a new policy requiring all employees to use multi-factor authentication (MFA). The workforce includes many warehouse staff who do not have company smartphones. What should the security team do to ensure successful implementation?

Exempt warehouse staff from the MFA policy because they do not access sensitive systems.

Require all employees to purchase a personal smartphone for MFA use.

Delay the policy until every employee has a company smartphone.

Provide hardware tokens to employees without smartphones and offer training sessions on how to use them.

A financial services firm has just approved a new acceptable use policy that restricts personal device usage. The security team wants to ensure employees understand and follow the new rules. Which action is most likely to improve compliance?

Enforce the policy through technical controls without explanation

Wait for employees to ask questions before providing details

Conduct mandatory training sessions and require employees to acknowledge the policy

Post the policy on the internal website and send a one-time email

A startup is developing its first security policy. The founders want to move fast, but investors require a formal policy before funding. The startup has no dedicated security team. What is the most effective approach?

Hire a full security team to develop the policy from scratch.

Write a simple one-page policy and publish it immediately.

Use a recognized framework as a starting point, customize it with input from key stakeholders, and obtain board approval.

Adopt the policy of a larger company without modification.

GIAC Security Leadership

Domain 1Objective 1

Managing Security Policy GSLC Practice Questions (Page 8)

Part of the Security Management and Governance domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 36–40

36application · medium
A university is developing a policy for research data handling. The policy must comply with federal regulations while also supporting academic freedom. Which approach best balances these needs?
Select an answer first
37foundation · easy
In the security policy lifecycle, what is the primary purpose of the retirement stage?
Select an answer first
38application · medium
A logistics company has a new policy requiring all employees to use multi-factor authentication (MFA). The workforce includes many warehouse staff who do not have company smartphones. What should the security team do to ensure successful implementation?
Select an answer first
39application · medium
A financial services firm has just approved a new acceptable use policy that restricts personal device usage. The security team wants to ensure employees understand and follow the new rules. Which action is most likely to improve compliance?
Select an answer first
40expert · hard
A startup is developing its first security policy. The founders want to move fast, but investors require a formal policy before funding. The startup has no dedicated security team. What is the most effective approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.