A multinational corporation is developing a security policy that must apply to both a high-security data center and a low-impact sales office. The policy must be consistent yet flexible. What is the best approach?

Write a policy that only covers the high-security data center

Create two completely separate policies, one for each facility type

Create a single high-level policy with separate standards for each facility type

Apply the same detailed controls to both facilities

A small branch office of a bank is classified as a low-impact facility because it handles no cash and only processes routine transactions. The branch manager wants to implement security controls. Which control is most appropriate?

A full-time armed security guard

A panic button connected to local law enforcement

A locked door with a keypad entry and a policy for visitor sign-in

A biometric scanner for all employees

A multinational company is developing a security policy for remote access. The policy must comply with data residency regulations in multiple jurisdictions, support a hybrid workforce, and be enforceable. The legal team has provided conflicting requirements: one region requires data to remain within its borders, while another requires access logs to be retained for two years. The CISO wants a single policy. What is the best approach?

Defer the policy until all legal requirements are harmonized

Adopt the strictest requirements from any region and apply them globally

Create separate, independent policies for each region

Create a single policy with regional annexes that specify jurisdiction-specific requirements

An organization's security policy is being reviewed. The policy states that 'all sensitive data must be encrypted.' However, it does not define what constitutes sensitive data. What is the most likely consequence of this ambiguity?

The policy will be considered void and unenforceable

The policy will be applied only to data stored in the cloud

Employees will interpret the policy inconsistently, leading to gaps in protection

The policy will be automatically enforced by technical controls

A low-impact facility is considering implementing a security control that costs $10,000 and reduces the risk of a $50,000 loss by 50%. The facility manager is unsure whether the control is justified. What is the best decision based on cost-benefit analysis?

Do not implement the control because the cost is too high

Implement the control only if the loss probability is greater than 50%

Implement the control because the expected loss reduction is $25,000, which exceeds the cost

Defer the decision until a full risk assessment is completed

GIAC Critical Infrastructure Protection (GCIP)

Domain 1Objective 3

Security Management Controls GCIP Practice Questions (Page 1)

Part of the Foundations and Governance domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 6–10 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

3concepts

Questions 1–5

1expert · hard
A multinational corporation is developing a security policy that must apply to both a high-security data center and a low-impact sales office. The policy must be consistent yet flexible. What is the best approach?
Select an answer first
2application · medium
A small branch office of a bank is classified as a low-impact facility because it handles no cash and only processes routine transactions. The branch manager wants to implement security controls. Which control is most appropriate?
Select an answer first
3expert · hard
A multinational company is developing a security policy for remote access. The policy must comply with data residency regulations in multiple jurisdictions, support a hybrid workforce, and be enforceable. The legal team has provided conflicting requirements: one region requires data to remain within its borders, while another requires access logs to be retained for two years. The CISO wants a single policy. What is the best approach?
Select an answer first
4application · medium
An organization's security policy is being reviewed. The policy states that 'all sensitive data must be encrypted.' However, it does not define what constitutes sensitive data. What is the most likely consequence of this ambiguity?
Select an answer first
5expert · hard
A low-impact facility is considering implementing a security control that costs $10,000 and reduces the risk of a $50,000 loss by 50%. The facility manager is unsure whether the control is justified. What is the best decision based on cost-benefit analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.