A manufacturing company stores its design documents on a file server that is accessible to all employees. A recent audit found that several employees have downloaded sensitive designs and shared them with competitors. The company wants to reduce the risk of data loss. Which control would be most effective in addressing this specific risk?

Install a network intrusion detection system (IDS).

Increase the frequency of full system backups.

Disable the USB ports on all employee workstations.

Implement data loss prevention (DLP) software that monitors and blocks unauthorized transfers.

A hospital's IT team is designing security for a new patient portal. They need to ensure that only authorized users can view medical records, that records are not altered without detection, and that the portal remains accessible to clinicians. Which set of controls best addresses all three requirements?

Role-based access control, file integrity monitoring, and redundant servers.

Encryption of all data, a firewall, and an intrusion detection system.

Multi-factor authentication, antivirus software, and a backup generator.

A VPN for remote access, a proxy server, and a load balancer.

A security team is designing a defense-in-depth strategy for a web application. They have implemented a web application firewall (WAF) and are considering adding an intrusion prevention system (IPS) and regular vulnerability scanning. Which statement best describes the value of adding the IPS and vulnerability scanning?

They are redundant because the WAF already blocks all attacks

They increase complexity without improving security

They are only useful for compliance, not for actual security

They provide additional layers that detect and block attacks the WAF might miss

GIAC Information Security Fundamentals

Domain 1Objective 1

Foundations of Cybersecurity GISF Practice Questions (Page 6)

Part of the Foundations and Risk Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 26–30

26foundation · easy
In the context of risk management, which term refers to a weakness in a system or control that could be exploited by a threat?
Select an answer first
27application · medium
A manufacturing company stores its design documents on a file server that is accessible to all employees. A recent audit found that several employees have downloaded sensitive designs and shared them with competitors. The company wants to reduce the risk of data loss. Which control would be most effective in addressing this specific risk?
Select an answer first
28application · medium
A company's security team is reviewing its incident response procedures. They want to ensure that after a security incident is contained, the organization can recover to a known good state. Which type of control is most directly associated with this goal?
Select an answer first
29application · medium
A hospital's IT team is designing security for a new patient portal. They need to ensure that only authorized users can view medical records, that records are not altered without detection, and that the portal remains accessible to clinicians. Which set of controls best addresses all three requirements?
Select an answer first
30expert · hard
A security team is designing a defense-in-depth strategy for a web application. They have implemented a web application firewall (WAF) and are considering adding an intrusion prevention system (IPS) and regular vulnerability scanning. Which statement best describes the value of adding the IPS and vulnerability scanning?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Foundations of Cybersecurity GISF Practice Questions (Page 6)

Questions 26–30

In the context of risk management, which term refers to a weakness in a system or control that could be exploited by a threat?

A company's security team is reviewing its incident response procedures. They want to ensure that after a security incident is contained, the organization can recover to a known good state. Which type of control is most directly associated with this goal?

Keep studying — Foundations and Risk Management