A corporation is updating its information protection program. The current program lacks a formal disposal process, and old hard drives are stored in a closet. The legal department requires that data be retained for at least five years, but the security team wants to reduce the risk of data breaches. What is the best approach?

Inventory the drives, identify the data they contain, and apply retention and disposal policies accordingly

Immediately destroy all hard drives in the closet

Sell the drives to a recycler without sanitization

Keep the drives in the closet until the legal retention period expires

A hospital is disposing of old paper medical records that have passed their retention period. The records contain patient names, diagnoses, and social security numbers. The hospital's disposal policy requires that the information be unreadable and unreconstructable. Which disposal method should be used?

Place the records in standard recycling bins.

Use a cross-cut shredder that meets the required particle size standard.

Soak the records in water before disposal.

Burn the records in an incinerator on site.

A financial institution is building an information protection program. The compliance team has identified that customer financial data is stored in a legacy mainframe, a cloud data warehouse, and on backup tapes. The data is not consistently classified. The institution must meet regulatory requirements that mandate encryption for customer financial data at rest and in transit. What should the institution do FIRST?

Migrate all customer financial data to the cloud data warehouse to simplify protection.

Conduct a comprehensive data inventory to identify all instances of customer financial data, then classify and apply encryption.

Implement encryption on the cloud data warehouse and the backup tapes.

Create a data classification policy that labels all customer financial data as 'Confidential'.

What is the primary purpose of identifying and inventorying information assets?

To ensure that all information is stored in a centralized repository

To assign a monetary value to every piece of information for insurance purposes

To know what information exists, where it resides, and how it is used so that appropriate protections can be applied

To reduce the total amount of data stored by deleting redundant copies

A healthcare organization stores patient data in an on-premises EHR system and in a cloud-based analytics platform. The data is classified as 'Confidential'. The organization is required to protect the data with appropriate safeguards. The cloud provider offers encryption at rest, but the organization is concerned about the cloud provider's ability to access the data. What should the organization do to maintain control over the data?

Rely on the cloud provider's encryption at rest and access controls.

Use client-side encryption so that the cloud provider only stores encrypted data without the keys.

Move all patient data back to the on-premises EHR system.

Ask the cloud provider to sign a business associate agreement (BAA) and rely on their security.

GIAC Critical Infrastructure Protection (GCIP)

Domain 5Objective 2

Information Protection GCIP Practice Questions (Page 7)

Part of the Recovery and Information Protection domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 6–9 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

6concepts

Questions 31–35

31expert · hard
A corporation is updating its information protection program. The current program lacks a formal disposal process, and old hard drives are stored in a closet. The legal department requires that data be retained for at least five years, but the security team wants to reduce the risk of data breaches. What is the best approach?
Select an answer first
32application · medium
A hospital is disposing of old paper medical records that have passed their retention period. The records contain patient names, diagnoses, and social security numbers. The hospital's disposal policy requires that the information be unreadable and unreconstructable. Which disposal method should be used?
Select an answer first
33expert · hard
A financial institution is building an information protection program. The compliance team has identified that customer financial data is stored in a legacy mainframe, a cloud data warehouse, and on backup tapes. The data is not consistently classified. The institution must meet regulatory requirements that mandate encryption for customer financial data at rest and in transit. What should the institution do FIRST?
Select an answer first
34foundation · easy
What is the primary purpose of identifying and inventorying information assets?
Select an answer first
35expert · hard
A healthcare organization stores patient data in an on-premises EHR system and in a cloud-based analytics platform. The data is classified as 'Confidential'. The organization is required to protect the data with appropriate safeguards. The cloud provider offers encryption at rest, but the organization is concerned about the cloud provider's ability to access the data. What should the organization do to maintain control over the data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.

Information Protection GCIP Practice Questions (Page 7)

Questions 31–35

What is the primary purpose of identifying and inventorying information assets?

Keep studying — Recovery and Information Protection