A healthcare organization's security program has implemented several new controls. The CISO needs to report progress to the board of directors, who are not security experts. What is the most effective reporting approach?

Report only on the budget spent versus the budget allocated for the security program.

Present only the number of security incidents that occurred, without context or trends.

Provide a dashboard that shows key performance indicators (KPIs) such as percentage of systems patched, time to remediate vulnerabilities, and number of security incidents, with trend lines.

Send a detailed technical report listing every vulnerability discovered and the specific CVEs addressed.

Which of the following is an example of a security program KPI?

Mean time to detect (MTTD) a security incident

Number of marketing campaigns launched

Employee satisfaction survey score

A hospital is updating its security program structure to comply with new health data regulations. The CISO needs to assign responsibility for ensuring that all security controls meet the regulatory requirements. Which role is most appropriate for this responsibility?

Each individual employee, who is responsible for ensuring their own work complies with regulations.

An external auditor who reviews the program annually.

The IT helpdesk manager, who can implement technical controls as needed.

A compliance officer within the security team who is responsible for mapping controls to regulatory requirements and coordinating audits.

Why should compliance and regulatory requirements be incorporated into the design of a security program structure?

To make the security program optional

To eliminate all security risks

To ensure the program meets legal obligations and avoids penalties

To reduce the need for security controls

GIAC Security Leadership

Domain 1Objective 2

Managing the Program Structure GSLC Practice Questions (Page 6)

Part of the Security Management and Governance domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

10concepts

Questions 26–30

26application · medium
A healthcare organization's security program has implemented several new controls. The CISO needs to report progress to the board of directors, who are not security experts. What is the most effective reporting approach?
Select an answer first
27foundation · easy
Which of the following is an example of a security program KPI?
Select an answer first
28foundation · easy
Which of the following is a core component of a security program structure?
Select an answer first
29application · medium
A hospital is updating its security program structure to comply with new health data regulations. The CISO needs to assign responsibility for ensuring that all security controls meet the regulatory requirements. Which role is most appropriate for this responsibility?
Select an answer first
30foundation · easy
Why should compliance and regulatory requirements be incorporated into the design of a security program structure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.