A hospital's information protection program classifies electronic health records (EHR) as 'Restricted'. The IT team is designing safeguards for the system that stores these records. Which combination of measures best aligns with the classification?

Physical locks on server room doors only, with no technical controls

Public Wi-Fi access for convenience, no encryption, and shared passwords

Role-based access control, full-disk encryption, and audit logging

Encryption only, with no access controls or monitoring

What is the primary purpose of an information protection program in an organization?

To ensure that all information is publicly accessible to promote transparency

To ensure that information is available only to authorized individuals and protected from unauthorized access, use, disclosure, disruption, modification, or destruction

To maximize the storage capacity of information systems by compressing all data

To eliminate the need for backup and recovery procedures by preventing data loss

A university lab is reassigning 20 laptops from a research project that handled confidential human-subject data to a new student training lab. The laptops have standard SATA SSDs. The lab manager wants to ensure that the data cannot be recovered while preserving the laptops for reuse. What should the lab do?

Physically destroy the SSDs and purchase new drives for the training lab.

Delete the user profiles and run a disk cleanup utility.

Run the built-in ATA Secure Erase command on each SSD, then reinstall the operating system.

Degauss each laptop's SSD before reimaging.

A hospital's information protection policy requires that patient records be protected at rest and in transit. The IT team is configuring a new file server for storing radiology images. Which safeguard should be implemented to protect the data at rest?

Implement a firewall rule to block external access

Enable BitLocker or similar full-disk encryption on the server

Use HTTPS for all web-based access

Set NTFS permissions to restrict access

A multinational company is building an information protection program. The compliance team needs to know which data elements are considered personal data under GDPR, where that data is stored, and which business unit owns each dataset. What should the program include to meet this need?

A data breach response plan that outlines notification procedures.

A data classification policy that labels all data as public, internal, or confidential.

A data retention schedule that specifies how long each data type must be kept.

A data inventory that records data types, formats, storage locations, and data owners.

GIAC Critical Infrastructure Protection (GCIP)

Domain 5Objective 2

Information Protection GCIP Practice Questions (Page 4)

Part of the Recovery and Information Protection domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

6concepts

Questions 16–20

16application · medium
A hospital's information protection program classifies electronic health records (EHR) as 'Restricted'. The IT team is designing safeguards for the system that stores these records. Which combination of measures best aligns with the classification?
Select an answer first
17foundation · easy
What is the primary purpose of an information protection program in an organization?
Select an answer first
18application · medium
A university lab is reassigning 20 laptops from a research project that handled confidential human-subject data to a new student training lab. The laptops have standard SATA SSDs. The lab manager wants to ensure that the data cannot be recovered while preserving the laptops for reuse. What should the lab do?
Select an answer first
19application · medium
A hospital's information protection policy requires that patient records be protected at rest and in transit. The IT team is configuring a new file server for storing radiology images. Which safeguard should be implemented to protect the data at rest?
Select an answer first
20application · medium
A multinational company is building an information protection program. The compliance team needs to know which data elements are considered personal data under GDPR, where that data is stored, and which business unit owns each dataset. What should the program include to meet this need?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.