SANS MGT514 EVALUATION 2026 TEST QUESTIONS
AND ANSWERS SURE A+
✔✔Marketing (the why) (2:210) - ✔✔imperative to the successful adoption of your
strategy/security initiatives and retaining top talent. MAKE SECURITY RELEVANT TO
THE BUSINESS AND THE BUSINESS RELEVANT TO SECURITY.
✔✔Marketing - SNAP (2:214) - ✔✔4 key components; Specify - marketing objectives;
Niche - identify Value propositition; Audience - Identify target market; Promote -
Distribution Strategy
✔✔Marketing objectives - Specify (2:216) - ✔✔marketing plans need objectives, and a
way of measuring success to ensure your marketing efforts are not wasted.
✔✔Marketing objectives - Niche (2:218) - ✔✔having a strong value proposition is of
critical importance because it sets you apart from other companies and competition.
✔✔Marketing objectives - Audience (2:219) - ✔✔Identify your target market/audience.
People/organizations that are key to your continued success, such as executives,
business units, employees, and customers.
✔✔Executives Unique - three things (2:220) - ✔✔They impact or provide oversight and
are accountable for nearly every aspect of the work that you do. Executives are busy,
required to make rapid decisions with limited information, have a complex enterprise to
run.
✔✔Board of Directors Concerns (2:221) - ✔✔must understand their role in the
organization, provide oversight & governance, not make day-to-day tactical decisions.
✔✔Goal for Board meeting (2:222) - ✔✔What do you want from executives; they feel
confident in your abilities; provide high level over view.
✔✔Making Ideas stick (2:224) - ✔✔Simple - find the core of your idea; Unexpected -
Grab attention with surprise; Concrete - Make sure they can be grasped & remembered;
Credible - make an idea believable; Emotional - Help people see the importance;
Stories - use narrative.
✔✔Albert Einstein (2:225) - ✔✔If you can't explain it simply, you don't understand it well
enough.
✔✔Leonardo da Vinci (2:233) - ✔✔Simplicity is the ultimate form of sophistication
✔✔Marketing objectives - Promote (2:234) - ✔✔Distribution strategy - determine how
your message will reach your audience.
,✔✔Market & Communicate to employees (2:235) - ✔✔Market to current employees to
retain talent; market to future employees to attract top talent
✔✔Market/communicate to customers (2:237) - ✔✔Customer recognition; Invite
customers to key conferences; security awareness & training.
✔✔Purpose of Policy (3:4) - ✔✔Policy protects the organization. Security policy
establishes what you must do to protect information stored on computers; will protect
company from legal & financial actions.
✔✔Reasonable Person Rule (3:6) - ✔✔takes into account the foreseeable risk of harm
actions create versus the utility of actions; extent of the risk so created; likelihood such
risk will actually cause harm to others; any alternatives of lesser risk and the cost of
those alternatives.
✔✔Protect Data: Technology Disposal Example (3:10) - ✔✔When tech assets reach
their end of life they should be properly disposed of.
✔✔Protecting PII (3:11) - ✔✔must protect SSN and PII from unauthorized disclosure
and access.
✔✔Policy protects information (3:12) - ✔✔two types of information; that which is
approved for public release and everything else.
✔✔Protect the organization - comply with laws/regulations (3:14) - ✔✔review common
legal, regulatory, and compliance frameworks.
✔✔International: PCI DSS (3:15) - ✔✔12 specific requirements designed to protect
cardholder data and to prevent fraud.
✔✔United States: HIPAA (3:16) - ✔✔Primarily focused on securing PHI. A covered
entity must adopt reasonable and appropriate policies and procedures to comply with
provisions of the Security Rule.
✔✔United States: Gramm-Leach-Bliley (GLBA) - ✔✔requires financial service
organizations "insure security and confidentiality of customer records and information.
✔✔United States: SOX (Sarbanes-Oxley) (3:20) - ✔✔intended to provide policies
enforcing ethical and honest accounting practices. primary concerns for SOX are the
accuracy and honesty of financial reports from publicly traded companies.
✔✔United States: SOX (Sarbanes-Oxley) (3:21) - ✔✔11 major elements; Public
Company accounting oversight board (PCAOB); Auditor Independence;
, Corporate/Individual Responsibility; Enhanced financial Disclosures; Analyst Conflicts of
interest; Commission resources and authority; studies and reports; corporate and
criminal fraud accountability; white collar crime penalty enhancement; corporate tax
returns; Corporate fraud accountability.
✔✔European Union:GDPR(3:23-24) - ✔✔Harmonizing 27 national data protection
regulations into one; improving user control of personal data; making it easier for
businesses to work with a single supervisory authority as a "one stop shop" for privacy
complaints.
✔✔European Union: Privacy (3:25) - ✔✔EU-US Privacy Shield is a framework for
transferring data from EU entities to the US.
✔✔Europen Union: NIS Directive (3:26) - ✔✔requires members states to develop a
national strategy on the security of network and information systems (including a
governance framework), designate computer security incident response team (CSIRT),
and cooperate at a national level.
✔✔China Cybersecurity law (3:27) - ✔✔focus on personal information protection and
critical infrastructure protection, which includes "public communication and information
services, power, traffic, water, finance, public service, electronic governance and other
critical information infrastructure.
✔✔Russia: Data Protection Law (3:29) - ✔✔laws apply to data operators who process
personal data and similar to other data protection laws, define various restrictions on
data processing. Consent is required to process data and data subjects must be
informed about the purpose of the collection, the volume of data used, and the duration
that is will be used.
✔✔Vendors and Third parties (3:30-32) - ✔✔shared assessments, BITS framework;
SSAE 16 (SOC 1, SOC2 Type I and Type II); ISO/IEC 27000 Series; Privacy Shield;
Standard Contractual Clauses and Binding corporate rules; Pen testing; Vuln scans; IT
general controls; strong contracts; other considerations.
✔✔Compliance by design (3:33) - ✔✔Policies should force compliance by design,
where the desired behavior of incorporating security best practices is woven into the
culture of the organization. Comprehensive security policies include understanding the
business value, legal & compliance implications, and security program design.
✔✔Security Policy Governance Life Cycle (3:35) - ✔✔Develop - initial process to
document drafts and revisions of security policies for ratification and adoption; Socialize
- distribute policies electronically or through awareness training, employee onboarding;
Measure - Ongoing effort to review compliance to policies and to provide enforcement
mechanisms to change behavior; Assess - reviewing policies as internal processes
AND ANSWERS SURE A+
✔✔Marketing (the why) (2:210) - ✔✔imperative to the successful adoption of your
strategy/security initiatives and retaining top talent. MAKE SECURITY RELEVANT TO
THE BUSINESS AND THE BUSINESS RELEVANT TO SECURITY.
✔✔Marketing - SNAP (2:214) - ✔✔4 key components; Specify - marketing objectives;
Niche - identify Value propositition; Audience - Identify target market; Promote -
Distribution Strategy
✔✔Marketing objectives - Specify (2:216) - ✔✔marketing plans need objectives, and a
way of measuring success to ensure your marketing efforts are not wasted.
✔✔Marketing objectives - Niche (2:218) - ✔✔having a strong value proposition is of
critical importance because it sets you apart from other companies and competition.
✔✔Marketing objectives - Audience (2:219) - ✔✔Identify your target market/audience.
People/organizations that are key to your continued success, such as executives,
business units, employees, and customers.
✔✔Executives Unique - three things (2:220) - ✔✔They impact or provide oversight and
are accountable for nearly every aspect of the work that you do. Executives are busy,
required to make rapid decisions with limited information, have a complex enterprise to
run.
✔✔Board of Directors Concerns (2:221) - ✔✔must understand their role in the
organization, provide oversight & governance, not make day-to-day tactical decisions.
✔✔Goal for Board meeting (2:222) - ✔✔What do you want from executives; they feel
confident in your abilities; provide high level over view.
✔✔Making Ideas stick (2:224) - ✔✔Simple - find the core of your idea; Unexpected -
Grab attention with surprise; Concrete - Make sure they can be grasped & remembered;
Credible - make an idea believable; Emotional - Help people see the importance;
Stories - use narrative.
✔✔Albert Einstein (2:225) - ✔✔If you can't explain it simply, you don't understand it well
enough.
✔✔Leonardo da Vinci (2:233) - ✔✔Simplicity is the ultimate form of sophistication
✔✔Marketing objectives - Promote (2:234) - ✔✔Distribution strategy - determine how
your message will reach your audience.
,✔✔Market & Communicate to employees (2:235) - ✔✔Market to current employees to
retain talent; market to future employees to attract top talent
✔✔Market/communicate to customers (2:237) - ✔✔Customer recognition; Invite
customers to key conferences; security awareness & training.
✔✔Purpose of Policy (3:4) - ✔✔Policy protects the organization. Security policy
establishes what you must do to protect information stored on computers; will protect
company from legal & financial actions.
✔✔Reasonable Person Rule (3:6) - ✔✔takes into account the foreseeable risk of harm
actions create versus the utility of actions; extent of the risk so created; likelihood such
risk will actually cause harm to others; any alternatives of lesser risk and the cost of
those alternatives.
✔✔Protect Data: Technology Disposal Example (3:10) - ✔✔When tech assets reach
their end of life they should be properly disposed of.
✔✔Protecting PII (3:11) - ✔✔must protect SSN and PII from unauthorized disclosure
and access.
✔✔Policy protects information (3:12) - ✔✔two types of information; that which is
approved for public release and everything else.
✔✔Protect the organization - comply with laws/regulations (3:14) - ✔✔review common
legal, regulatory, and compliance frameworks.
✔✔International: PCI DSS (3:15) - ✔✔12 specific requirements designed to protect
cardholder data and to prevent fraud.
✔✔United States: HIPAA (3:16) - ✔✔Primarily focused on securing PHI. A covered
entity must adopt reasonable and appropriate policies and procedures to comply with
provisions of the Security Rule.
✔✔United States: Gramm-Leach-Bliley (GLBA) - ✔✔requires financial service
organizations "insure security and confidentiality of customer records and information.
✔✔United States: SOX (Sarbanes-Oxley) (3:20) - ✔✔intended to provide policies
enforcing ethical and honest accounting practices. primary concerns for SOX are the
accuracy and honesty of financial reports from publicly traded companies.
✔✔United States: SOX (Sarbanes-Oxley) (3:21) - ✔✔11 major elements; Public
Company accounting oversight board (PCAOB); Auditor Independence;
, Corporate/Individual Responsibility; Enhanced financial Disclosures; Analyst Conflicts of
interest; Commission resources and authority; studies and reports; corporate and
criminal fraud accountability; white collar crime penalty enhancement; corporate tax
returns; Corporate fraud accountability.
✔✔European Union:GDPR(3:23-24) - ✔✔Harmonizing 27 national data protection
regulations into one; improving user control of personal data; making it easier for
businesses to work with a single supervisory authority as a "one stop shop" for privacy
complaints.
✔✔European Union: Privacy (3:25) - ✔✔EU-US Privacy Shield is a framework for
transferring data from EU entities to the US.
✔✔Europen Union: NIS Directive (3:26) - ✔✔requires members states to develop a
national strategy on the security of network and information systems (including a
governance framework), designate computer security incident response team (CSIRT),
and cooperate at a national level.
✔✔China Cybersecurity law (3:27) - ✔✔focus on personal information protection and
critical infrastructure protection, which includes "public communication and information
services, power, traffic, water, finance, public service, electronic governance and other
critical information infrastructure.
✔✔Russia: Data Protection Law (3:29) - ✔✔laws apply to data operators who process
personal data and similar to other data protection laws, define various restrictions on
data processing. Consent is required to process data and data subjects must be
informed about the purpose of the collection, the volume of data used, and the duration
that is will be used.
✔✔Vendors and Third parties (3:30-32) - ✔✔shared assessments, BITS framework;
SSAE 16 (SOC 1, SOC2 Type I and Type II); ISO/IEC 27000 Series; Privacy Shield;
Standard Contractual Clauses and Binding corporate rules; Pen testing; Vuln scans; IT
general controls; strong contracts; other considerations.
✔✔Compliance by design (3:33) - ✔✔Policies should force compliance by design,
where the desired behavior of incorporating security best practices is woven into the
culture of the organization. Comprehensive security policies include understanding the
business value, legal & compliance implications, and security program design.
✔✔Security Policy Governance Life Cycle (3:35) - ✔✔Develop - initial process to
document drafts and revisions of security policies for ratification and adoption; Socialize
- distribute policies electronically or through awareness training, employee onboarding;
Measure - Ongoing effort to review compliance to policies and to provide enforcement
mechanisms to change behavior; Assess - reviewing policies as internal processes
