A company acquires a smaller firm and needs to give the acquired employees access to its internal applications. The company uses SAML-based federation with its identity provider. What is the primary benefit of using federation in this scenario?

The company can automatically provision accounts for all acquired employees without any identity data exchange

The company can enforce stronger password policies on the acquired firm's identity provider

Employees use their existing credentials from the acquired firm to access the company's applications

The company can eliminate the need for any identity provider for the acquired employees

A company has a document that is marked 'Confidential' and contains trade secrets. According to data classification best practices, what should be the primary consideration when determining protection measures?

The sensitivity level of the data

The cost of implementing the protection

The storage location of the data

The number of users who need access

GIAC Information Security Fundamentals

Domain 4Objective 2

Identity, Access and Data Protection GISF Practice Questions (Page 4)

Part of the Cryptography and Identity domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 16–20

16application · medium
A company acquires a smaller firm and needs to give the acquired employees access to its internal applications. The company uses SAML-based federation with its identity provider. What is the primary benefit of using federation in this scenario?
Select an answer first
17application · medium
A healthcare organization is implementing a data classification policy. They have a dataset containing patient names, diagnoses, and social security numbers. According to common data classification levels, how should this dataset be classified?
Select an answer first
18application · medium
A company has a document that is marked 'Confidential' and contains trade secrets. According to data classification best practices, what should be the primary consideration when determining protection measures?
Select an answer first
19application · medium
A company is developing a data classification policy. They need to categorize data that, if disclosed, would cause moderate harm to the company's reputation but is not subject to regulatory requirements. Which classification level is most appropriate?
Select an answer first
20foundation · easy
Which security concept ensures that a user's actions can be traced back to that user?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Identity, Access and Data Protection GISF Practice Questions (Page 4)

Questions 16–20

A company acquires a smaller firm and needs to give the acquired employees access to its internal applications. The company uses SAML-based federation with its identity provider. What is the primary benefit of using federation in this scenario?

A healthcare organization is implementing a data classification policy. They have a dataset containing patient names, diagnoses, and social security numbers. According to common data classification levels, how should this dataset be classified?

A company has a document that is marked 'Confidential' and contains trade secrets. According to data classification best practices, what should be the primary consideration when determining protection measures?

A company is developing a data classification policy. They need to categorize data that, if disclosed, would cause moderate harm to the company's reputation but is not subject to regulatory requirements. Which classification level is most appropriate?

Which security concept ensures that a user's actions can be traced back to that user?

Keep studying — Cryptography and Identity