Personnel & Training GCIP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A hospital is implementing an access management program for its electronic health record (EHR) system. The program must balance the need for quick access in emergencies with the principle of least privilege. The hospital has a large number of temporary staff and rotating residents. Which approach best balances these requirements?

   • ARequire temporary staff to request access each time they need it, with no standing access.
   • BUse a single shared account for all temporary staff to simplify management.
   • CImplement role-based access control (RBAC) with break-glass accounts for emergencies, and conduct regular access reviews to adjust permissions as roles change.
   • DGrant all clinical staff full access to the EHR to ensure no delays in patient care.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the purpose of ongoing monitoring in personnel risk assessment?

   • ATo ensure employees maintain the required security clearances and do not exhibit behaviors that increase risk.
   • BTo verify that employees are using their access rights appropriately.
   • CTo ensure employees are not sharing company information on social media.
   • DTo track employee productivity and performance for annual reviews.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A financial institution is conducting a personnel risk assessment for a candidate who will have access to high-value trading systems. The background check reveals a recent bankruptcy and a history of gambling. The candidate is highly skilled and the position is difficult to fill. What is the best course of action?

   • AAssess the candidate's financial situation and gambling history as potential risk factors, and consider mitigations such as enhanced monitoring or restricted access.
   • BHire the candidate but require them to sign a personal financial disclosure form.
   • CHire the candidate and grant full access because the position is difficult to fill.
   • DReject the candidate because any financial issues are an automatic disqualifier for access to trading systems.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is implementing an access management program. The security team wants to implement periodic access reviews. The HR department is concerned about the workload. Which approach balances security and administrative burden?

   • AConduct reviews only when an employee changes roles.
   • BConduct annual reviews for all users, regardless of role.
   • CConduct continuous automated reviews for all users.
   • DConduct quarterly reviews for all users, focusing on high-risk roles and privileged accounts.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A hospital system is updating its cybersecurity training for clinical staff. The staff have limited time and varied technical backgrounds. The training must cover phishing, password hygiene, and incident reporting, and the effectiveness must be measurable. Which training approach is most appropriate?

   • ARequire all staff to attend a full-day instructor-led workshop on advanced security topics.
   • BConduct a one-time security awareness fair with games and prizes.
   • CProvide role-based, online micro-learning modules followed by short scenario-based assessments.
   • DDistribute a printed security handbook and ask staff to sign an acknowledgment.
   Reveal Solution Discussion Select an answer first