A government contractor handles data classified as 'Secret'. The contractor's facility has a secure room with badge access, and the network is isolated from the internet. The contractor wants to allow remote work for employees who handle Secret data. What is the most important control to implement?

Send classified documents to employees via encrypted email.

Allow employees to use their personal devices if they have antivirus software installed.

Provide employees with company-owned laptops that have full-disk encryption.

Require employees to use a VPN with multi-factor authentication to access the isolated network.

A financial firm is decommissioning an old SAN that contains customer account data. The SAN will be returned to the leasing company. The firm's policy requires that data be unrecoverable before the device leaves the premises. Which disposal method should the firm use?

Use a cryptographic erase if the SAN supports self-encrypting drives, then verify the encryption key has been destroyed.

Delete the files and then empty the recycle bin on each volume.

Perform a quick format of all logical volumes on the SAN.

Overwrite the SAN with a single pass of zeros using a vendor tool.

A multinational corporation is implementing a data classification scheme. The legal team requires that customer personal data be classified as 'Confidential' and that it be stored only in approved regions. The marketing team wants to use customer email addresses for a global campaign. The IT team has discovered that customer data is stored in three different cloud regions and on local file servers. What is the most important first step to reconcile these requirements?

Block marketing's access to customer email addresses until the classification is finalized.

Conduct a data inventory to identify all locations of customer personal data, then apply the Confidential classification consistently.

Immediately move all customer data to a single approved cloud region.

Create a data classification policy that labels customer data as Confidential and defines handling requirements.

A government contractor handles documents marked 'Secret'. The contractor's facility has a secure room with a badge-controlled door. What additional safeguard is most important to protect the documents while they are being used in the room?

Use a paper shredder located outside the room

Install a fire suppression system

Require personnel to sign a nondisclosure agreement

Implement a clean-desk policy and prohibit personal devices in the room

Which of the following is a typical component of an information protection program lifecycle?

Procurement, installation, and decommissioning of hardware

Assessment, design, implementation, operation, and continuous improvement

Data entry, data processing, and report generation

Marketing, sales, and customer support

GIAC Critical Infrastructure Protection (GCIP)

Domain 5Objective 2

Information Protection GCIP Practice Questions (Page 2)

Part of the Recovery and Information Protection domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

6concepts

Questions 6–10

6expert · hard
A government contractor handles data classified as 'Secret'. The contractor's facility has a secure room with badge access, and the network is isolated from the internet. The contractor wants to allow remote work for employees who handle Secret data. What is the most important control to implement?
Select an answer first
7application · medium
A financial firm is decommissioning an old SAN that contains customer account data. The SAN will be returned to the leasing company. The firm's policy requires that data be unrecoverable before the device leaves the premises. Which disposal method should the firm use?
Select an answer first
8expert · hard
A multinational corporation is implementing a data classification scheme. The legal team requires that customer personal data be classified as 'Confidential' and that it be stored only in approved regions. The marketing team wants to use customer email addresses for a global campaign. The IT team has discovered that customer data is stored in three different cloud regions and on local file servers. What is the most important first step to reconcile these requirements?
Select an answer first
9application · medium
A government contractor handles documents marked 'Secret'. The contractor's facility has a secure room with a badge-controlled door. What additional safeguard is most important to protect the documents while they are being used in the room?
Select an answer first
10foundation · easy
Which of the following is a typical component of an information protection program lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.