A company is implementing a security framework and must decide between a risk-based approach (like NIST CSF) and a compliance-based approach (like PCI DSS). The company has a limited budget and wants to avoid over-spending on controls that may not be necessary. Which approach is more aligned with their goal?

Compliance-based approach, because it ensures all required controls are implemented.

Neither, because frameworks are not useful for small companies.

Risk-based approach, because it prioritizes controls based on the organization's specific risks.

Both equally, because they are interchangeable.

A company has experienced a data breach where customer credit card numbers were stolen. The investigation reveals that the attacker used a phishing email to obtain an employee's credentials and then accessed a database that was not encrypted. Which combination of controls would have been most effective in preventing this breach?

Network segmentation and intrusion detection system (IDS)

Multi-factor authentication and database encryption

User training and data loss prevention (DLP)

Antivirus software and a firewall

Which of the following correctly describes the relationship between risk, threat, and vulnerability?

A threat is the likelihood that a vulnerability will be exploited

Risk is the potential for harm when a threat exploits a vulnerability

Risk is the absence of vulnerabilities in a system

A vulnerability is a potential harm that can affect an asset

A financial services firm has a policy that requires all employees to complete annual security awareness training. The training includes modules on recognizing phishing emails, safe internet usage, and reporting suspicious activity. Which threat is this training primarily designed to mitigate?

Distributed denial of service (DDoS) attacks

GIAC Information Security Fundamentals

Domain 1Objective 1

Foundations of Cybersecurity GISF Practice Questions (Page 5)

Part of the Foundations and Risk Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 21–25

21application · medium
An attacker sends an email to a company's finance department, pretending to be the CEO and urgently requesting a wire transfer to a vendor. This is an example of which type of threat?
Select an answer first
22expert · hard
A company is implementing a security framework and must decide between a risk-based approach (like NIST CSF) and a compliance-based approach (like PCI DSS). The company has a limited budget and wants to avoid over-spending on controls that may not be necessary. Which approach is more aligned with their goal?
Select an answer first
23expert · hard
A company has experienced a data breach where customer credit card numbers were stolen. The investigation reveals that the attacker used a phishing email to obtain an employee's credentials and then accessed a database that was not encrypted. Which combination of controls would have been most effective in preventing this breach?
Select an answer first
24foundation · easy
Which of the following correctly describes the relationship between risk, threat, and vulnerability?
Select an answer first
25application · medium
A financial services firm has a policy that requires all employees to complete annual security awareness training. The training includes modules on recognizing phishing emails, safe internet usage, and reporting suspicious activity. Which threat is this training primarily designed to mitigate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Foundations of Cybersecurity GISF Practice Questions (Page 5)

Questions 21–25

An attacker sends an email to a company's finance department, pretending to be the CEO and urgently requesting a wire transfer to a vendor. This is an example of which type of threat?

Which of the following correctly describes the relationship between risk, threat, and vulnerability?

A financial services firm has a policy that requires all employees to complete annual security awareness training. The training includes modules on recognizing phishing emails, safe internet usage, and reporting suspicious activity. Which threat is this training primarily designed to mitigate?

Keep studying — Foundations and Risk Management