What is the role of compliance in system security management?

To ensure security practices align with legal, regulatory, and organizational requirements

To focus only on external regulations and ignore internal policies

To replace the need for technical security controls

To guarantee that no security breaches will occur

In access control, what is the difference between authentication and authorization?

Authentication verifies identity; authorization determines what the authenticated user can do.

Authentication is used for users; authorization is used for systems.

Authentication controls access to networks; authorization controls access to data.

Authentication determines permissions; authorization verifies identity.

A security analyst discovers that a critical vulnerability in a widely used web server software has been publicly disclosed and exploits are already appearing in the wild. The affected servers are internet-facing and support customer transactions. What should the organization do first?

Apply the vendor-provided security patch to all affected servers during the next scheduled maintenance window.

Implement temporary mitigating controls, such as a web application firewall rule, and then test and deploy the patch as soon as possible.

Disable the affected web server software on all servers until a patch is available.

Increase logging on the affected servers and monitor for suspicious activity without changing configurations.

A security manager is designing access controls for a new document management system. The system will store highly sensitive legal documents. The manager must ensure that only authorized legal team members can view the documents, and that any unauthorized access attempt is logged and alerted. Which combination of controls best achieves this?

Implement role-based access control (RBAC) so only the legal team role can view documents, and enable audit logging for all access attempts with alerts on failed logins.

Encrypt the documents at rest and provide the decryption key to all employees.

Use a shared password for the legal team to access the document repository, and rely on the file server's built-in logging.

Grant all employees read access to the documents, but require them to sign a non-disclosure agreement (NDA).

Which activity is an example of applying a system hardening standard?

Increasing the number of user accounts with administrative privileges

Disabling unnecessary services and closing unused ports

Installing the latest office productivity software

Connecting the system to a public network for easier access

GIAC Security Leadership

Domain 2Objective 1

Managing System Security GSLC Practice Questions (Page 4)

Part of the Technical Security Management domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 16–20

16foundation · easy
What is the role of compliance in system security management?
Select an answer first
17foundation · easy
In access control, what is the difference between authentication and authorization?
Select an answer first
18application · medium
A security analyst discovers that a critical vulnerability in a widely used web server software has been publicly disclosed and exploits are already appearing in the wild. The affected servers are internet-facing and support customer transactions. What should the organization do first?
Select an answer first
19application · medium
A security manager is designing access controls for a new document management system. The system will store highly sensitive legal documents. The manager must ensure that only authorized legal team members can view the documents, and that any unauthorized access attempt is logged and alerted. Which combination of controls best achieves this?
Select an answer first
20foundation · easy
Which activity is an example of applying a system hardening standard?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.