A company is implementing a new access control system. They need to ensure that employees can access only the resources necessary for their roles, but they also need to allow temporary access for a contractor who will work on a project for two weeks. Which combination of controls best meets these requirements?

Discretionary access control (DAC) where each employee sets permissions on their own files.

A single shared account for all contractors.

Mandatory access control (MAC) with labels for all resources.

Role-based access control (RBAC) with time-limited accounts for the contractor.

A software vendor distributes a signed update package. A system administrator downloads the package and verifies the digital signature using the vendor's public key. Which two security properties does this verification provide?

Non-repudiation and confidentiality

Authenticity and confidentiality

What is the primary purpose of a cryptographic hash function?

To create a secret key for symmetric encryption

To encrypt data so it cannot be read

To compress data for storage efficiency

To produce a fixed-size output that verifies data integrity

A security consultant is hired by a company to test the security of its web application. The contract explicitly authorizes the consultant to perform penetration testing against the application's production environment during a specified time window. The consultant discovers a critical vulnerability and immediately exploits it to access customer data. What is the primary ethical or legal issue with this action?

The consultant should have used a staging environment instead of production.

The consultant should have reported the vulnerability without exploiting it.

The consultant should have obtained a warrant before performing the test.

The consultant exceeded the scope of the authorization by accessing customer data.

GIAC Foundational Cybersecurity Technologies

Domain 5Objective 1

Security Concepts GFACT Practice Questions (Page 4)

Part of the Security Fundamentals domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 6–9 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

6concepts

Questions 16–20

16expert · hard
A company is implementing a new access control system. They need to ensure that employees can access only the resources necessary for their roles, but they also need to allow temporary access for a contractor who will work on a project for two weeks. Which combination of controls best meets these requirements?
Select an answer first
17application · medium
A software vendor distributes a signed update package. A system administrator downloads the package and verifies the digital signature using the vendor's public key. Which two security properties does this verification provide?
Select an answer first
18foundation · easy
What is the primary purpose of a cryptographic hash function?
Select an answer first
19application · medium
A security consultant is hired by a company to test the security of its web application. The contract explicitly authorizes the consultant to perform penetration testing against the application's production environment during a specified time window. The consultant discovers a critical vulnerability and immediately exploits it to access customer data. What is the primary ethical or legal issue with this action?
Select an answer first
20foundation · easy
What is the process of converting ciphertext back into plaintext called?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GFACT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GFACT” is a trademark of its owner, used for identification only.

Security Concepts GFACT Practice Questions (Page 4)

Questions 16–20

A software vendor distributes a signed update package. A system administrator downloads the package and verifies the digital signature using the vendor's public key. Which two security properties does this verification provide?

What is the primary purpose of a cryptographic hash function?

What is the process of converting ciphertext back into plaintext called?

Keep studying — Security Fundamentals