A company is merging with another company and needs to give the new employees access to its internal applications. The security team wants to minimize the administrative burden of managing separate accounts and passwords. They also want to ensure that when an employee leaves the acquired company, their access is revoked promptly. Which approach best meets these requirements?

Create separate accounts for each acquired employee and manually revoke access when they leave

Use single sign-on with a shared password for all acquired employees

Implement federated identity management with automated deprovisioning

Give all acquired employees the same role and rely on periodic access reviews

A company wants to strengthen authentication for remote employees logging into the VPN. Currently they use only a username and password. They want to add a factor that is something the user has, but they are concerned about employees losing physical tokens. Which option best satisfies the requirement?

Add a security question like 'What is your mother's maiden name?'

Send a one-time passcode via SMS to the employee's personal phone

Require a biometric fingerprint scan on the laptop

Require a one-time passcode generated by an authenticator app on the employee's smartphone

A company wants to implement multi-factor authentication for remote access. The security team decides to use a hardware token that generates a one-time passcode, combined with a PIN. Which authentication factors are being used?

Knowledge (PIN) and inherence (biometric)

Knowledge (PIN) and location (IP address)

Possession (token) and inherence (fingerprint)

Possession (token) and knowledge (PIN)

A healthcare organization needs to share patient data with a research partner for analysis. They want to protect the data in transit and ensure that only the partner can read it. Which technique should they use?

Masking the data before transmission

Tokenizing the data before transmission

Hashing the data before transmission

Encrypting the data with the partner's public key

GIAC Information Security Fundamentals

Domain 4Objective 2

Identity, Access and Data Protection GISF Practice Questions (Page 6)

Part of the Cryptography and Identity domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 26–30

26expert · hard
A company is merging with another company and needs to give the new employees access to its internal applications. The security team wants to minimize the administrative burden of managing separate accounts and passwords. They also want to ensure that when an employee leaves the acquired company, their access is revoked promptly. Which approach best meets these requirements?
Select an answer first
27application · medium
A company wants to strengthen authentication for remote employees logging into the VPN. Currently they use only a username and password. They want to add a factor that is something the user has, but they are concerned about employees losing physical tokens. Which option best satisfies the requirement?
Select an answer first
28foundation · easy
In Identity and Access Management (IAM), what is the process of creating user accounts and granting initial permissions called?
Select an answer first
29application · medium
A company wants to implement multi-factor authentication for remote access. The security team decides to use a hardware token that generates a one-time passcode, combined with a PIN. Which authentication factors are being used?
Select an answer first
30application · medium
A healthcare organization needs to share patient data with a research partner for analysis. They want to protect the data in transit and ensure that only the partner can read it. Which technique should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Identity, Access and Data Protection GISF Practice Questions (Page 6)

Questions 26–30

In Identity and Access Management (IAM), what is the process of creating user accounts and granting initial permissions called?

A company wants to implement multi-factor authentication for remote access. The security team decides to use a hardware token that generates a one-time passcode, combined with a PIN. Which authentication factors are being used?

A healthcare organization needs to share patient data with a research partner for analysis. They want to protect the data in transit and ensure that only the partner can read it. Which technique should they use?

Keep studying — Cryptography and Identity