A manufacturing company's security team is designing controls for its industrial control system (ICS) network. The team wants to detect an intruder who has already bypassed the perimeter firewall and is moving laterally inside the network. Which control is most effective for this purpose?

Strengthen the perimeter firewall rules to block more external IP addresses.

Deploy network segmentation and monitor east-west traffic between ICS zones.

Install antivirus software on all ICS workstations.

Conduct annual penetration tests of the ICS network.

Which sequence correctly represents the typical order of steps in a cyber risk assessment?

Asset identification → Threat identification → Vulnerability analysis → Risk calculation

Vulnerability analysis → Asset identification → Threat identification → Risk calculation

Risk calculation → Asset identification → Threat identification → Vulnerability analysis

Threat identification → Asset identification → Risk calculation → Vulnerability analysis

A company has a mature risk management program with quarterly risk reviews. After a major merger, they integrate a new subsidiary's IT systems. The subsidiary has a different risk assessment methodology and a higher risk appetite. The merged company must maintain compliance with industry regulations. What is the most effective way to update the risk management process?

Adopt the subsidiary's higher risk appetite to minimize friction

Conduct a one-time risk assessment and then revert to the original quarterly reviews

Harmonize the risk assessment methodology and recalibrate risk appetite to align with the merged company's regulatory obligations

Keep the two methodologies separate to preserve each company's practices

A company has deployed a new web application. The security team wants to detect and respond to SQL injection attempts. Which control combination should they implement?

A VPN and a data loss prevention (DLP) system

A load balancer and a backup solution

A web application firewall (WAF) and an intrusion detection system (IDS)

A firewall and an antivirus solution

A multinational company processes personal data of EU citizens and is subject to GDPR. They are evaluating a new data storage provider that offers lower costs but stores data in a country without an adequacy decision. What should the company do to manage the compliance risk?

Transfer the data anyway and rely on the provider's privacy policy

Anonymize all personal data before transfer, so GDPR no longer applies

Proceed with the lower-cost provider and accept the risk of non-compliance

Choose a provider with data centers in an EU member state or one that provides appropriate safeguards, such as standard contractual clauses

GIAC Information Security Fundamentals

Domain 1Objective 2

Managing and Mitigating Cyber Risk GISF Practice Questions (Page 9)

Part of the Foundations and Risk Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

6concepts

Questions 41–45

41application · medium
A manufacturing company's security team is designing controls for its industrial control system (ICS) network. The team wants to detect an intruder who has already bypassed the perimeter firewall and is moving laterally inside the network. Which control is most effective for this purpose?
Select an answer first
42foundation · easy
Which sequence correctly represents the typical order of steps in a cyber risk assessment?
Select an answer first
43expert · hard
A company has a mature risk management program with quarterly risk reviews. After a major merger, they integrate a new subsidiary's IT systems. The subsidiary has a different risk assessment methodology and a higher risk appetite. The merged company must maintain compliance with industry regulations. What is the most effective way to update the risk management process?
Select an answer first
44application · medium
A company has deployed a new web application. The security team wants to detect and respond to SQL injection attempts. Which control combination should they implement?
Select an answer first
45application · medium
A multinational company processes personal data of EU citizens and is subject to GDPR. They are evaluating a new data storage provider that offers lower costs but stores data in a country without an adequacy decision. What should the company do to manage the compliance risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.