A security consultant is advising a client that must comply with a regulation requiring a formal risk management process. The client also wants to improve its security posture quickly. The consultant recommends adopting a framework that provides a structured risk management process AND a prioritized set of controls. Which combination of frameworks would best meet both needs?

CIS Controls for the process and NIST RMF for the controls

COBIT for the process and PCI DSS for the controls

ISO 27001 for the process and OWASP Top 10 for the controls

NIST RMF for the process and CIS Controls for the controls

A small e-commerce company wants to improve its security posture but has limited staff and budget. The owner asks for a practical starting point that provides a structured approach to identifying and prioritizing security improvements. Which recommendation is the most appropriate first step?

Adopt a recognized security framework and perform a risk assessment.

Hire a penetration testing firm to conduct a one-time security test.

Purchase a next-generation firewall and install it at the network perimeter.

Implement a password manager and require multi-factor authentication for all employees.

GIAC Information Security Fundamentals

Domain 1Objective 1

Foundations of Cybersecurity GISF Practice Questions (Page 3)

Part of the Foundations and Risk Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 11–15

11application · medium
A hospital stores patient records in a database that is accessible only from the internal network. The IT team discovers that a misconfigured backup job has been copying the database to a publicly accessible cloud storage bucket. Which element of the risk equation does the misconfiguration represent?
Select an answer first
12expert · hard
A security consultant is advising a client that must comply with a regulation requiring a formal risk management process. The client also wants to improve its security posture quickly. The consultant recommends adopting a framework that provides a structured risk management process AND a prioritized set of controls. Which combination of frameworks would best meet both needs?
Select an answer first
13foundation · easy
A security analyst notices that an attacker has modified financial records in a database. Which component of the CIA triad has been violated?
Select an answer first
14application · medium
A small e-commerce company wants to improve its security posture but has limited staff and budget. The owner asks for a practical starting point that provides a structured approach to identifying and prioritizing security improvements. Which recommendation is the most appropriate first step?
Select an answer first
15expert · hard
A company's database administrator accidentally deletes a critical table from the production database. The company has a backup from the previous night. The security team is asked to assess the impact. Which security goal is most directly affected by this incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Foundations of Cybersecurity GISF Practice Questions (Page 3)

Questions 11–15

A security analyst notices that an attacker has modified financial records in a database. Which component of the CIA triad has been violated?

A small e-commerce company wants to improve its security posture but has limited staff and budget. The owner asks for a practical starting point that provides a structured approach to identifying and prioritizing security improvements. Which recommendation is the most appropriate first step?

A company's database administrator accidentally deletes a critical table from the production database. The company has a backup from the previous night. The security team is asked to assess the impact. Which security goal is most directly affected by this incident?

Keep studying — Foundations and Risk Management