A hospital's electronic health record (EHR) system must be available 24/7 for patient care. The IT team is considering two controls: a redundant failover system and a strict access control policy. The hospital has a limited budget and must choose one. Which control should they prioritize to maintain patient safety?

Neither, because the hospital should rely on manual processes

Both are equally important and should be implemented together

A company is deciding whether to invest in a new security control. The control costs $50,000 to implement and is expected to reduce the annualized loss expectancy (ALE) from $200,000 to $20,000. The control has a 5-year lifespan. Which decision is most financially justified?

Implement the control because the reduction in ALE exceeds the cost

Do not implement because the residual risk is still $20,000

Implement only if the control also improves confidentiality

Do not implement because the cost is too high

A user's laptop is stolen. The laptop has full-disk encryption enabled, and the user's files are backed up to the cloud. Which statement best describes the impact on the CIA triad?

Integrity is compromised because the laptop is stolen

Confidentiality is preserved, but availability may be temporarily affected

Confidentiality is compromised because the laptop is in the attacker's hands

Availability is fully maintained because of the cloud backup

A security team is designing a defense-in-depth strategy for a web application. They have implemented a firewall, an intrusion detection system (IDS), and encryption. They are now considering adding a web application firewall (WAF) and a SIEM system. Which combination of controls would provide the most comprehensive coverage?

Neither, because the existing controls are sufficient.

GIAC Information Security Fundamentals

Domain 1Objective 1

Foundations of Cybersecurity GISF Practice Questions (Page 8)

Part of the Foundations and Risk Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 36–40

36expert · hard
A hospital's electronic health record (EHR) system must be available 24/7 for patient care. The IT team is considering two controls: a redundant failover system and a strict access control policy. The hospital has a limited budget and must choose one. Which control should they prioritize to maintain patient safety?
Select an answer first
37expert · hard
A company is deciding whether to invest in a new security control. The control costs $50,000 to implement and is expected to reduce the annualized loss expectancy (ALE) from $200,000 to $20,000. The control has a 5-year lifespan. Which decision is most financially justified?
Select an answer first
38application · medium
A user's laptop is stolen. The laptop has full-disk encryption enabled, and the user's files are backed up to the cloud. Which statement best describes the impact on the CIA triad?
Select an answer first
39expert · hard
A security team is designing a defense-in-depth strategy for a web application. They have implemented a firewall, an intrusion detection system (IDS), and encryption. They are now considering adding a web application firewall (WAF) and a SIEM system. Which combination of controls would provide the most comprehensive coverage?
Select an answer first
40foundation · easy
Which of the following is a widely recognized framework for establishing and improving an organization's information security program?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Foundations of Cybersecurity GISF Practice Questions (Page 8)

Questions 36–40

A company is deciding whether to invest in a new security control. The control costs $50,000 to implement and is expected to reduce the annualized loss expectancy (ALE) from $200,000 to $20,000. The control has a 5-year lifespan. Which decision is most financially justified?

A user's laptop is stolen. The laptop has full-disk encryption enabled, and the user's files are backed up to the cloud. Which statement best describes the impact on the CIA triad?

Which of the following is a widely recognized framework for establishing and improving an organization's information security program?

Keep studying — Foundations and Risk Management