A university's IT department has implemented a new security control to reduce the risk of phishing attacks. Six months later, the CISO wants to know if the control is still effective. What is the BEST way to monitor the risk over time?

Ask employees to self-report their phishing susceptibility.

Conduct a one-time penetration test to verify the control.

Review metrics such as the number of phishing incidents reported and the success rate of simulated phishing campaigns.

Wait for the next annual risk assessment to re-evaluate the risk.

When selecting a security framework for an organization, which factor is most important to consider?

The framework that is the most popular in the industry

The framework that requires the least amount of documentation

The framework that is easiest to implement regardless of business needs

The framework that aligns with the organization's industry, regulatory requirements, and risk profile

Why is ongoing risk monitoring important after a risk assessment has been completed?

To guarantee that no new risks will appear

To satisfy all regulatory requirements automatically

To ensure that risks remain at acceptable levels as the environment changes

To eliminate the need for future risk assessments

A public sector organization must demonstrate to regulators that it has a formal process for identifying, assessing, and managing risks to its information assets. The organization has implemented various security tools but lacks a documented, repeatable risk management process. What should the organization do to meet this governance requirement?

Adopt a recognized security framework and integrate it into the organization's governance structure.

Purchase additional security tools to enhance technical controls.

Hire an external auditor to conduct a one-time risk assessment.

Document the current ad-hoc practices and submit them to regulators.

GIAC Security Leadership

Domain 1Objective 3

Risk Management and Security Frameworks GSLC Practice Questions (Page 8)

Part of the Security Management and Governance domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 36–40

36application · medium
A university's IT department has implemented a new security control to reduce the risk of phishing attacks. Six months later, the CISO wants to know if the control is still effective. What is the BEST way to monitor the risk over time?
Select an answer first
37foundation · easy
When selecting a security framework for an organization, which factor is most important to consider?
Select an answer first
38foundation · easy
Why is ongoing risk monitoring important after a risk assessment has been completed?
Select an answer first
39application · medium
A public sector organization must demonstrate to regulators that it has a formal process for identifying, assessing, and managing risks to its information assets. The organization has implemented various security tools but lacks a documented, repeatable risk management process. What should the organization do to meet this governance requirement?
Select an answer first
40application · medium
A government contractor must align its security program with a framework that provides a common language for cybersecurity and is widely used across federal agencies. The contractor is not required to achieve certification but must demonstrate compliance with the framework's categories. Which framework is the most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Risk Management and Security Frameworks GSLC Practice Questions (Page 8)

Questions 36–40

A university's IT department has implemented a new security control to reduce the risk of phishing attacks. Six months later, the CISO wants to know if the control is still effective. What is the BEST way to monitor the risk over time?

When selecting a security framework for an organization, which factor is most important to consider?

Why is ongoing risk monitoring important after a risk assessment has been completed?

Keep studying — Security Management and Governance