What is the first step in applying a security framework to an organization?

Understanding the organization's current security posture and business context

Hiring an external consultant to take over security operations

Immediately implementing all controls from the framework

Purchasing security software recommended by the framework

Which security framework is best known for providing a comprehensive set of cybersecurity controls and is widely used as a baseline for security programs?

NIST Cybersecurity Framework (CSF)

What is the primary purpose of risk communication in the risk management process?

To publicly disclose all security vulnerabilities to customers

To assign blame for security incidents

To document risks for legal proceedings

To share risk information with stakeholders to support informed decision-making

After a risk assessment, a healthcare organization's CISO needs to report the top risks to the board of directors. The board is not technical and is primarily concerned with financial impact and regulatory exposure. What is the most effective way to communicate the risk findings?

Present a detailed technical report listing all vulnerabilities and CVSS scores.

Provide a dashboard showing risks in terms of potential financial loss and likelihood, with mitigation status.

Use a risk register with likelihood and impact ratings for each risk.

Email the full risk assessment document and ask for questions.

GIAC Security Leadership

Domain 1Objective 3

Risk Management and Security Frameworks GSLC Practice Questions (Page 9)

Part of the Security Management and Governance domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 41–44

41foundation · easy
What is the first step in applying a security framework to an organization?
Select an answer first
42foundation · easy
Which security framework is best known for providing a comprehensive set of cybersecurity controls and is widely used as a baseline for security programs?
Select an answer first
43foundation · easy
What is the primary purpose of risk communication in the risk management process?
Select an answer first
44application · medium
After a risk assessment, a healthcare organization's CISO needs to report the top risks to the board of directors. The board is not technical and is primarily concerned with financial impact and regulatory exposure. What is the most effective way to communicate the risk findings?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.