A technology company is implementing a personnel risk assessment program for employees who will have administrative access to critical systems. The program must include initial screening and periodic reviews. Which practice is most effective?

Perform a background check only if a supervisor requests it based on observed behavior.

Rely on employee self-disclosure of any legal or financial issues during annual reviews.

Conduct a background check only at the time of promotion to a sensitive role.

Conduct background checks before employment and perform periodic re-screening, such as credit checks and criminal record reviews, for employees in sensitive roles.

A security team is developing an awareness program. The program includes phishing simulations, newsletters, and training sessions. Which metric would best indicate the program's success in changing employee behavior?

The number of employees who complete the training modules.

The number of security incidents that occur each month.

The number of employees who attend the training sessions.

The percentage of employees who report phishing emails to the security team.

A large organization has a diverse workforce, including remote workers, field technicians, and office staff. The security team is designing a training program. Which approach best ensures that all employees receive effective training?

Use only e-learning modules to ensure consistency across the workforce.

Use a single generic training video for all employees.

Use a blended approach: e-learning modules for all, plus role-specific workshops for high-risk roles.

Use only in-person workshops to maximize engagement.

A hospital is hiring a new network administrator who will have access to patient records and critical systems. The HR department wants to conduct a background check. Which combination of checks is most appropriate for this position?

Reference checks and educational verification only.

Social media screening and personality assessment.

Drug screening and physical fitness test.

Criminal history, employment verification, and credit check.

A healthcare organization is designing an access management program for its electronic health record (EHR) system. The program must ensure that only authorized personnel can view patient data and that access is appropriate for each role. Which combination of principles is essential?

Single sign-on, password rotation, and multi-factor authentication.

Least privilege, need-to-know, and regular access reviews.

Open access by default, with restrictions only for employees with disciplinary issues.

Role-based access control, but only for new employees.

GIAC Critical Infrastructure Protection (GCIP)

Domain 3Objective 2

Personnel & Training GCIP Practice Questions (Page 8)

Part of the Physical and Personnel Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 36–40

36application · medium
A technology company is implementing a personnel risk assessment program for employees who will have administrative access to critical systems. The program must include initial screening and periodic reviews. Which practice is most effective?
Select an answer first
37expert · hard
A security team is developing an awareness program. The program includes phishing simulations, newsletters, and training sessions. Which metric would best indicate the program's success in changing employee behavior?
Select an answer first
38expert · hard
A large organization has a diverse workforce, including remote workers, field technicians, and office staff. The security team is designing a training program. Which approach best ensures that all employees receive effective training?
Select an answer first
39application · medium
A hospital is hiring a new network administrator who will have access to patient records and critical systems. The HR department wants to conduct a background check. Which combination of checks is most appropriate for this position?
Select an answer first
40application · medium
A healthcare organization is designing an access management program for its electronic health record (EHR) system. The program must ensure that only authorized personnel can view patient data and that access is appropriate for each role. Which combination of principles is essential?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.