You can see it againUnder pressure people bring back shapes and positions long after the wording has gone.
Picture superiority · Shepard 1967, Standing 1973
GIAC (SANS)GIAC Security Leadership
The GIAC Security Leadership (GSLC) certification validates your ability to lead security teams by blending practical technical controls with strategic governance. It is designed for information security managers and security professionals with leadership responsibilities who must protect, detect, and respond to security issues across the entire security lifecycle. Earning GSLC demonstrates that you can build security programs that meet business needs, manage security operations and teams, and oversee security projects from start to finish.
Exam formatProctored exam
Duration180 minutes
DeliveryGIAC
Passing score70%
Free questions1002
Content last reviewed 30 July 2026 · Up to date
The certification
What GIAC Security Leadership proves, and what it asks of you
What this certification covers, who it is written for, and what the exam itself looks like on the day.
6domains
19objectives
184concepts
What it is
What this certification is
What it validates, who it is written for, and the experience it assumes.
About this certification
The GIAC Security Leadership (GSLC) certification validates a practitioner's ability to employ governance and technical controls to protect, detect, and respond to security issues. GSLC certification holders are equipped with key management topics that address the overall security lifecycle, and with deep knowledge of data, network, host, application, and user controls.
This certification is designed for professionals who lead security teams and need to blend practical skill with strategic governance. It covers building a security program that meets business needs, managing security operations and teams, and managing security projects and the lifecycle of the program. By earning GSLC, you demonstrate readiness to lead security teams, implement technical guardrails, and align security initiatives with organizational objectives.
Who it’s for
The GSLC certification is for information security managers, security professionals with leadership responsibilities, and IT and other managers who oversee security functions. It is ideal for those who need to understand both the technical and managerial aspects of cybersecurity to effectively lead teams and programs. Candidates typically have experience in security operations, risk management, or IT management and are looking to formalize their leadership skills with a recognized credential that validates their ability to protect, detect, and respond to security issues.
Recommended experience
Practical work experience in security management or leadership roles is recommended to ensure mastery of the skills necessary for certification. Experience managing security operations or teams; Understanding of security governance and risk management; Familiarity with technical security controls across network, host, application, and data layers
The syllabus
What you’ll learn
Every domain and objective GIAC (SANS) measures, with the weight they carry on the exam.
The official GIAC (SANS) exam outline · checked 30 July 2026 · See the source
Security Management and Governance
- Managing Security Policy
- Managing the Program Structure
- Risk Management and Security Frameworks
Technical Security Management
- Managing System Security
- Managing Network Security
- Managing Cloud Security
- Managing Application Security
- Managing Artificial Intelligence
Security Operations and Incident Management
- Managing a Security Operations Center
- Network Monitoring for Managers
- Incident Response and Business Continuity
- Vulnerability Management
Cryptography and Privacy
- Cryptography Concepts for Managers
- Managing Encryption and Privacy
Business and Vendor Management
- Managing Negotiations and Vendors
- Managing Projects
- Managing Security Awareness
Network and Security Architecture
- Networking Concepts for Managers
- Network Security Architecture
On the day
The exam itself
Everything GIAC (SANS) publishes about sitting it, and nothing we inferred.
Prerequisites
No mandatory prerequisites — this certification has no required predecessor exam or credential.
CertificationGIAC Security Leadership
Exam formatProctored exam
Duration180 minutes
Questions115 questions
Passing score70%
DeliveryGIAC
LanguagesEnglish
After you pass
Where this credential goes next
The path GIAC (SANS) lays out, how the credential is kept, and where to book.
Step-by-step path to GIAC Security Leadership
Credential earnedGIAC Security Leadership Certification Renewal and maintenance
GIAC certifications must be renewed every four years by earning 36 CPE credits or retaking the exam. Stay current with the latest technologies and maintain your certification.
Learn more about renewal requirements Lifecycle status
This certification is currently active and available. GIAC (SANS) maintains this certification to validate current skills and industry relevance.
Exam status: ActiveMaintained by GIAC (SANS)
Exam registration
Register for the exam through GIAC, GIAC (SANS)’s authorized testing partner.
Schedule your examVisit the official GIAC (SANS) certification page for exam policies and requirements.
View the official pageYour coach
And when you are serious, your coach Pip takes over
Your coach in the app reads what you have answered with the book closed and tells you one thing to do tonight. It will not count an answer you gave with the page open, and it will tell you when you are not ready.
See how the coach worksBefore you book
Questions people ask
How does GSLC relate to the GIAC Security Essentials (GSEC) certification?
GSLC is a Practitioner-level certification focused on security leadership and management, while GSEC validates foundational security skills. They are separate certifications; GSLC is not a prerequisite for GSEC or vice versa.
Is there a hands-on or lab component in the GSLC exam?
The GSLC exam is a proctored, multiple-choice exam with 115 questions. It does not include a hands-on lab component like some other GIAC certifications.
What is the retake policy if I fail the GSLC exam?
GIAC allows candidates to retake the exam after a waiting period. Specific retake policies are detailed in the GIAC terms and conditions on the official website.
Can I earn CPE credits for the GSLC renewal by attending SANS courses?
Yes, SANS training courses and conferences are eligible for CPE credits toward GIAC certification renewal, including GSLC.
What job roles does the GSLC certification map to?
GSLC is designed for information security managers, security professionals with leadership responsibilities, and IT managers who oversee security functions.
Are there any regional restrictions for taking the GSLC exam?
GIAC exams are available globally through remote proctoring via ProctorU and onsite proctoring through PearsonVUE, subject to availability in your region.
Information freshness · Content last reviewed on 2026-07-30 Up to date
Practice free questions 1002 questions, free, no account needed.
The curriculum
The whole exam, mapped and written
Every domain, every objective, and every concept GIAC (SANS) measures — each one written out.
6domains
19objectives
184concepts
210free pages
The domains, and what sits inside them
Every objective below is a page you can open and practise now, without an account.
The official GIAC (SANS) exam outline · checked 30 July 2026 · See the source
1Security Management and Governance152 questions
2Technical Security Management271 questions
3Security Operations and Incident Management199 questions
4Cryptography and Privacy98 questions
5Business and Vendor Management182 questions
6Network and Security Architecture100 questions
Not a table of contents
Every line on this map already opens
In front of every objective the practice pages are already there, free and without an account. This is one objective, opened.
Managing Security Policy11 pagesOpen →
Free in front of it
51 questions on this objective, five to a page. Every range above is a real page, open now, with no account.
Reading the map is not the same as knowing the ground
The curriculum tells you what is on the exam. Proving you know it is a different job — and it is the one the closed-book run does.
Free questions
1002 questions. No account, no card.
The whole bank is open. 5 questions to a page, every answer explained, and a discussion thread on each one.
1002questions
210pages
19objectives
Freealways
Browse by domain
Every objective, and every page range, is a link — so you can pick up exactly where you left off.
1Security Management and Governance152 questions
2Technical Security Management271 questions
3Security Operations and Incident Management199 questions
4Cryptography and Privacy98 questions
5Business and Vendor Management182 questions
6Network and Security Architecture100 questions
What a practice page gives you
1Five to a page
Short enough to finish, long enough to matter.
2Every answer explained
Not only which one is right — why the others are wrong.
3A discussion on each
Ask, answer, and vote. Every question has its own thread.
A question, and the idea behind it
Every question comes from a concept
These are not trivia. Each one is written against a concept in the book, so when you get one wrong there is somewhere to go and find out why.
The visual book
See it once. Carry it into the exam.
The pages shown here come from our AI-900 book — an example of how each concept is written in plain language and, where the idea needs one, drawn as a full page you can take in at a glance.
184concepts
1002free questions
Why a picture, and not another paragraph
Three reasons, and each one is a real finding rather than a slogan.
You can see it againThe whole idea at onceWhere it starts, what happens in the middle, what comes out, and the mistake to avoid.
Multimedia principle · MayerThe look-alikes sit togetherThe pairs the exam tests are drawn side by side, so the difference is seen, not told.
Dual coding · PaivioWhat one page is made of
You are never asked to read a poster here — only to see how one is built. After that, every other page is legible at a glance.
1A numbered strip on top
The idea as a sequence, followed with a finger before a word is read.
2Panels for the parts
What it is, how the machine learns it, when it is the right tool.
3The trap, framed
The distinction the exam tests, given its own box instead of buried in prose.
4One line at the bottom
The sentence to carry into the exam room.
Open book, on purpose
Answer it with the picture beside you
This is the part that teaches. The illustration and the written explanation stay where they are while you work, so a scenario stops being a memory test and becomes something you can simply look at.
It teaches · it does not count
A smartphone uses AI to unlock when the owner looks at the camera. Which AI capability is being used?
AImage classification
BFacial recognition
COptical character recognition
DObject detection
Look at the five steps. Detect finds a face, align straightens it, encode turns it into numbers, search compares it with a stored face, and decide answers one question: is this the same person? Classification would only say “a face”. Detection would only draw a box. Neither decides whose.
Then the page shuts, and it starts counting
The same questions come back with the book closed — that run is the one that counts. After it, your coach picks one thing for tonight, sized to the time you have, and brings pages back before you lose them.
Testing effect · Roediger & Karpicke 2006 · spacing effect · Cepeda et al. 2006
Official resources
Straight from GIAC (SANS)
Where the exam is defined, scheduled and scored.
2official links
184concepts mapped
The source
GIAC (SANS)’s own pages
We link to them rather than repeat them, so nothing here goes stale behind them.
Checked against the source
Every objective on the official GIAC (SANS) outline already has questions here
We build from the official skills outline, not from a summary of it — 19 objectives, 184 concepts written under them, and free questions against every one. When GIAC (SANS) changes the outline, this page changes with it.
19objectives on the outline→184concepts written→1002free questions
An official page tells you what will be asked. It cannot tell you what you will get right.
That is the only question worth answering the night before, and no link answers it. You answer it by taking the questions with the book closed, and seeing what comes back.