A company's security policy prohibits the use of personal USB drives. However, an employee uses one to transfer files and inadvertently introduces malware that spreads to the network. Which control would be most effective in enforcing this policy?

Conduct annual security awareness training

Provide employees with company-issued USB drives

Increase the frequency of antivirus scans

Configure endpoint DLP (Data Loss Prevention) to block unauthorized USB devices

A company wants to reduce the risk of initial access via phishing and credential theft, but they have a limited budget. Which control provides the best cost-effective protection?

Implement multi-factor authentication (MFA) for all remote access

Deploy a network access control (NAC) system

Hire a 24/7 security operations center (SOC)

Purchase an advanced endpoint detection and response (EDR) tool

What is the primary goal of social engineering in the context of initial access?

To intercept network traffic to steal data

To manipulate people into performing actions or revealing information that compromises security

To exploit software vulnerabilities in a network

To brute-force passwords on a web application

GIAC Information Security Fundamentals

Domain 3Objective 2

Intrusion and Initial Access Techniques GISF Practice Questions (Page 4)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 16–20

16application · medium
A company's security policy prohibits the use of personal USB drives. However, an employee uses one to transfer files and inadvertently introduces malware that spreads to the network. Which control would be most effective in enforcing this policy?
Select an answer first
17application · medium
An attacker sends an email to a specific finance employee, referencing a recent invoice and containing a malicious attachment. The email is personalized with the employee's name and job title. Which technique is this?
Select an answer first
18expert · hard
A company wants to reduce the risk of initial access via phishing and credential theft, but they have a limited budget. Which control provides the best cost-effective protection?
Select an answer first
19application · medium
An attacker calls an employee, pretending to be a senior executive, and urgently asks for the employee's login credentials to fix a 'critical issue.' The employee provides them. Which social engineering tactic is this?
Select an answer first
20foundation · easy
What is the primary goal of social engineering in the context of initial access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Intrusion and Initial Access Techniques GISF Practice Questions (Page 4)

Questions 16–20

A company's security policy prohibits the use of personal USB drives. However, an employee uses one to transfer files and inadvertently introduces malware that spreads to the network. Which control would be most effective in enforcing this policy?

An attacker sends an email to a specific finance employee, referencing a recent invoice and containing a malicious attachment. The email is personalized with the employee's name and job title. Which technique is this?

A company wants to reduce the risk of initial access via phishing and credential theft, but they have a limited budget. Which control provides the best cost-effective protection?

An attacker calls an employee, pretending to be a senior executive, and urgently asks for the employee's login credentials to fix a 'critical issue.' The employee provides them. Which social engineering tactic is this?

What is the primary goal of social engineering in the context of initial access?

Keep studying — Threats and Defenses