A low-impact facility is considering implementing a security policy that requires all visitors to be escorted. However, the facility hosts public tours that would be impractical to escort. What is the best solution?

Ignore the policy for public tours

Modify the policy to allow unescorted access to public areas while restricting access to sensitive areas

Cancel all public tours to comply with the policy

Require all visitors to sign a liability waiver instead of escorting

A rural community center that hosts occasional public events is classified as a low-impact facility. The center has a single entrance and no security staff. What is the most appropriate security management control to implement?

Hire a 24/7 security guard service

Install a biometric access control system on all doors

Deploy a full video surveillance system with remote monitoring

Implement a simple sign-in sheet and a staff member to monitor the entrance

A regional water utility is updating its security governance framework. The board has approved a new security policy, but the IT manager is unsure who has the authority to approve exceptions to the policy. According to the organization's governance structure, which role should formally approve any exception to the security policy?

The Chief Information Security Officer (CISO)

The Senior Manager or executive sponsor of the policy

The external auditor reviewing the policy

The IT manager responsible for implementing the policy

A company is implementing a new security policy that requires all employees to use multi-factor authentication (MFA). The policy is approved by the CEO, but the IT department is concerned about the cost and complexity. What is the best way to address this conflict?

Cancel the policy because IT objects

Have the CEO and IT director jointly review the policy and adjust the implementation timeline

Let IT decide whether to enforce the policy

Implement the policy exactly as written without any adjustments

A small non-profit organization with a low-impact office wants to create a security policy. The organization has limited resources and no dedicated security staff. What is the most practical approach?

Adopt a simple policy that outlines basic security expectations and assigns responsibility to the office manager

Skip the policy and rely on common sense

Implement a comprehensive policy based on a large enterprise template

Hire a full-time security manager to develop the policy

GIAC Critical Infrastructure Protection (GCIP)

Domain 1Objective 3

Security Management Controls GCIP Practice Questions (Page 5)

Part of the Foundations and Governance domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 6–10 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

3concepts

Questions 21–25

21expert · hard
A low-impact facility is considering implementing a security policy that requires all visitors to be escorted. However, the facility hosts public tours that would be impractical to escort. What is the best solution?
Select an answer first
22application · medium
A rural community center that hosts occasional public events is classified as a low-impact facility. The center has a single entrance and no security staff. What is the most appropriate security management control to implement?
Select an answer first
23application · medium
A regional water utility is updating its security governance framework. The board has approved a new security policy, but the IT manager is unsure who has the authority to approve exceptions to the policy. According to the organization's governance structure, which role should formally approve any exception to the security policy?
Select an answer first
24expert · hard
A company is implementing a new security policy that requires all employees to use multi-factor authentication (MFA). The policy is approved by the CEO, but the IT department is concerned about the cost and complexity. What is the best way to address this conflict?
Select an answer first
25application · medium
A small non-profit organization with a low-impact office wants to create a security policy. The organization has limited resources and no dedicated security staff. What is the most practical approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.