A small business wants to improve its security posture but has limited budget and no dedicated security staff. They need a practical starting point that is widely recognized and provides a prioritized set of actions. Which approach should they adopt?

Deploy a next-generation firewall for all network traffic

Implement the CIS Critical Security Controls

Adopt a zero-trust architecture immediately

Conduct a full penetration test quarterly

A company is conducting a risk assessment for its customer database. They identify that a successful ransomware attack could encrypt the database and cause significant downtime. The company decides to implement daily backups and test restoration procedures. In risk management terms, what is the company doing?

Mitigating the risk by reducing the impact of a ransomware attack.

Transferring the risk to a third party.

Accepting the risk without any action.

Avoiding the risk by eliminating the threat.

A hospital is planning to implement a new electronic health record (EHR) system. The risk management team is conducting a risk assessment. They identify that a power outage could make the EHR unavailable for several hours, impacting patient care. They decide to install an uninterruptible power supply (UPS) and a backup generator. In risk management terms, what is the UPS and generator considered?

Controls that mitigate the risk of power loss

Vulnerabilities in the EHR system

A hospital is evaluating its risk management approach for a new patient portal. The portal will store sensitive health data. The hospital must balance patient safety (availability) with strict privacy regulations (confidentiality). The security team proposes implementing multi-factor authentication (MFA) for all users, encrypting all data, and deploying redundant servers. However, the clinical staff complain that MFA slows down access during emergencies. Which approach best balances the competing requirements?

Remove MFA to ensure fast access for clinicians at all times.

Keep MFA but require it for every access, including emergencies.

Implement MFA with a break-glass emergency access procedure that allows temporary access with audit logging.

Use only a strong password policy and rely on encryption for protection.

GIAC Information Security Fundamentals

Domain 1Objective 1

Foundations of Cybersecurity GISF Practice Questions (Page 4)

Part of the Foundations and Risk Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 16–20

16application · medium
A small business wants to improve its security posture but has limited budget and no dedicated security staff. They need a practical starting point that is widely recognized and provides a prioritized set of actions. Which approach should they adopt?
Select an answer first
17expert · hard
A company is conducting a risk assessment for its customer database. They identify that a successful ransomware attack could encrypt the database and cause significant downtime. The company decides to implement daily backups and test restoration procedures. In risk management terms, what is the company doing?
Select an answer first
18application · medium
A hospital is planning to implement a new electronic health record (EHR) system. The risk management team is conducting a risk assessment. They identify that a power outage could make the EHR unavailable for several hours, impacting patient care. They decide to install an uninterruptible power supply (UPS) and a backup generator. In risk management terms, what is the UPS and generator considered?
Select an answer first
19expert · hard
A hospital is evaluating its risk management approach for a new patient portal. The portal will store sensitive health data. The hospital must balance patient safety (availability) with strict privacy regulations (confidentiality). The security team proposes implementing multi-factor authentication (MFA) for all users, encrypting all data, and deploying redundant servers. However, the clinical staff complain that MFA slows down access during emergencies. Which approach best balances the competing requirements?
Select an answer first
20foundation · easy
An employee with legitimate access to company systems intentionally exfiltrates sensitive customer data to a competitor. Which type of threat does this represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Foundations of Cybersecurity GISF Practice Questions (Page 4)

Questions 16–20

A small business wants to improve its security posture but has limited budget and no dedicated security staff. They need a practical starting point that is widely recognized and provides a prioritized set of actions. Which approach should they adopt?

An employee with legitimate access to company systems intentionally exfiltrates sensitive customer data to a competitor. Which type of threat does this represent?

Keep studying — Foundations and Risk Management