GIAC GSLC Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Security Leadership (GSLC) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GSLC certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GSLC Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Security Leadership (GSLC) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Security Leadership exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GSLC Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GSLC Sample Questions:
01. Six months ago you launched an awareness programme built around making suspicious messages easy to report. Reports to the service desk have risen from about twenty a month to about a hundred and eighty, and roughly eighty-five per cent turn out to be marketing email or internal notices rather than attacks. Click rates on your simulations have fallen over the same period. The service desk manager wants staff told to report only when they are confident, to cut the handling load.
What should you conclude, and what should you do?
a) Most reports concern marketing mail; ask marketing and internal communications to change how their messages are formatted and sent.
b) Report volume says little about effectiveness; judge the programme instead on how many staff complete the training.
c) The campaign over-corrected; ask staff to report only messages that request credentials or payment, which will restore a manageable volume.
d) People are noticing and telling you; keep the channel open and reduce the cost of triage with automation.
02. Your organisation outsources security monitoring to a provider whose contract obliges it to detect and escalate intrusions. An intrusion went undetected for six weeks because the provider had misconfigured its own collection. Your regulator has asked who was accountable for the failure to detect.
How should the organisation answer?
a) The organisation is answerable for the outcome. The contract governs what it can recover from the provider, not who is accountable.
b) The organisation is answerable only where it failed to oversee the provider, and documented oversight discharges it.
c) The provider is answerable, since the contract made detection its obligation and the failure was in its configuration.
d) Accountability is shared in the proportion set by the contract's liability provisions, which is what a regulator applies.
03. After a competitor disclosed a serious breach, your board has instructed you to adopt a recognised security framework. Your programme already operates a documented set of controls, recorded in a format of your own devising, and is subject to sector regulation.
How should you approach the instruction?
a) Engage an assessor to certify the programme, so the board receives independent confirmation that its instruction has been carried out.
b) Adopt the framework your competitor was assessed against, so the board can compare your programme with the one whose breach prompted the request.
c) Implement the framework's full control set on the schedule the board has set, since partial adoption cannot be claimed as conformance.
d) Select the framework that fits your regulatory and business context, map your existing controls to it, and prioritise the gaps it exposes.
04. The contract with your sole managed security service provider is up for renewal in three months, and the board has asked you to reduce its cost. The provider has operated your monitoring for six years, knows that migrating would be disruptive for you, and has opened by proposing an increase.
What should you do first to strengthen your position going into the negotiation?
a) Tell the provider early that the board has set a cost reduction target, so the requirement is clear, and terms follow from it.
b) Benchmark the provider's pricing against comparable services, so the discussion opens with evidence of the market rate.
c) Decide before talks open what you would do if no agreement is reached by qualifying an alternative provider you could credibly move to.
d) Assemble the missed service targets from the current term, so performance failures can be raised during the discussion.
05. You are procuring a three-year security transformation. The first phase, an identity management rebuild, is specified in detail. The two later phases depend on what the first phase finds, and cannot be scoped yet. Finance has asked you to place the whole engagement on a firm fixed price so the board can be given one number.
How should you respond?
a) Fix the price for the defined first phase and use a ceiling-capped reimbursable arrangement for the rest of the programme.
b) Accept a fixed price for the whole engagement, since it puts cost risk on the seller and gives finance the single figure requested.
c) Use time and materials throughout, since it needs no scope definition and the rate card lets finance model the monthly cost.
d) Use cost plus percentage of cost throughout, since the fee then scales with the effort each phase actually turns out to need.
06. A supplier processes customer records on your behalf. It completed your security questionnaire at onboarding three years ago and scored acceptable; the completed questionnaire is on file. Since then the supplier has taken on two further business processes for you and now holds a substantially larger data set. No further assessment has been carried out.
What is the principal weakness of this arrangement?
a) A questionnaire records what the supplier states about its controls rather than what an independent party has observed.
b) Risk was measured once, when the relationship was smaller, and nothing has re-measured it as the supplier's role has grown.
c) The supplier's score has never been compared with the rest of the portfolio, so there is no basis for ranking which relationship to review first.
d) The assessment covered the supplier's own controls but not those of the subcontractors it relies on to deliver the service.
07. The same class of input-validation defect has appeared in each of your last four releases, in different components and from different teams. Pre-release testing has caught almost every instance, so few have reached customers, but the rework is consuming a growing share of each release window.
Which change is most likely to reduce how often the defect recurs?
a) Add a check for this defect class to the pre-release test suite, so every instance is caught before the release is approved.
b) Document each occurrence against the responsible team and report the monthly counts to engineering leadership.
c) Write the validation requirement into the acceptance criteria that developers are trained against so that the expectation is set before the code is written.
d) Ask the security team to review any component that handles user input before the change is merged.
08. Your development organisation ships quarterly, and all application security testing is done in the two weeks before each release. The head of engineering considers this efficient, because every defect is found before anything reaches a customer, and asks why you also want security effort spent during requirements and design.
What is the strongest management argument for moving security activity earlier in the lifecycle?
a) Remediation cost rises sharply with each phase a defect survives, so the same finding is far cheaper to resolve in design than in a release candidate.
b) Design review and testing surface different classes of defect, so running both raises the number of findings recorded each quarter.
c) Earlier involvement shows the security team what engineering is building, so testing capacity can be planned across the whole quarter.
d) Design reviews let the security team approve the architecture before build begins, so fewer releases are held at the final gate.
09. Application security review is a mandatory sign-off five working days before each release. Over the last three quarters the review has raised findings that engineering says arrive too late to fix, and roughly two in five releases now ship under a documented exemption. The exemptions are recorded correctly and the review team is meeting its stated turnaround.
Which change addresses the cause of the exemptions?
a) Require an executive signature on every exemption, so shipping without sign-off becomes a decision senior management sees.
b) Move the security work upstream into design and build so findings arrive while the team can still act on them.
c) Add reviewers to the security team so the sign-off turns around in one working day instead of five.
d) Move the sign-off gate two weeks earlier in the release calendar, so teams have time to remediate, and hold the ship date firm.
10. Your teams deploy several times a day through an automated pipeline. Your security process requires a manual review of every change that touches authentication or data handling, which currently takes two to three days. Teams have begun routing urgent changes through the emergency path, which skips the review entirely, and that path now carries about a third of qualifying changes.
What should you do?
a) Restrict the emergency path to changes you approve, and review every use of it at the weekly change board.
b) Publish the review queue and the time it takes, so teams can schedule their changes around the security review.
c) Automate the checks into the pipeline so that security runs at the speed of delivery, and keep manual review for the handful of changes automation cannot judge.
d) Ask each team to nominate a developer who performs the review locally before the change enters the pipeline.
Answers:
|
Question: 01 Answer: d |
Question: 02 Answer: a |
Question: 03 Answer: d |
Question: 04 Answer: c |
Question: 05 Answer: a |
|
Question: 06 Answer: b |
Question: 07 Answer: c |
Question: 08 Answer: a |
Question: 09 Answer: b |
Question: 10 Answer: c |
Note: For any error in GIAC Security Leadership (GSLC) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
