Security Foundations and Awareness GISF Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A hospital is planning its security awareness program. The program must reduce the risk of phishing attacks, which have caused several malware infections. The hospital also needs to ensure that patient data remains confidential. Which training topic should be prioritized?

   • ARecognizing phishing emails and reporting suspicious messages.
   • BReviewing the hospital's disaster recovery plan.
   • CUnderstanding the importance of data encryption.
   • DLearning how to use the hospital's electronic health record system.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company has a high rate of employees falling for phishing emails. The security team is considering several awareness initiatives. The company has a limited budget and wants the most effective approach. Which initiative should they choose?

   • AA one-time mandatory training session for all employees
   • BPosting signs near computers reminding employees to be cautious
   • CMonthly simulated phishing emails with immediate feedback and targeted training for repeat offenders
   • DSending a weekly email newsletter with security tips
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is developing a data retention policy. The policy must comply with legal requirements to keep financial records for seven years, but also minimize storage costs. The company wants to ensure that records are not accidentally deleted before the retention period ends. Which control should be implemented?

   • AImplement automated retention controls that prevent deletion before the required period.
   • BStore all records indefinitely to avoid any risk of deletion.
   • CRely on employees to manually delete records after seven years.
   • DEncrypt all records to protect them from deletion.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A multinational corporation is planning its annual security awareness training. The training must cover phishing, password hygiene, and data protection. The company has offices in regions with different regulatory requirements. What is the most important consideration when designing the training content?

   • AMake training optional for employees who have passed previous assessments.
   • BUse a single global training module to ensure consistency.
   • CFocus only on phishing because it is the most common threat.
   • DTailor the training to address region-specific regulations and cultural contexts.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A regional bank is implementing a new customer portal. The security team has identified that customer account balances are the most critical data asset. During a risk assessment, they determine that a prolonged outage of the portal would cause significant reputational damage and regulatory fines. Which control should the bank prioritize to address the primary risk to the portal?

   • AConduct quarterly security awareness training for portal users.
   • BDeploy redundant infrastructure and failover mechanisms to minimize downtime.
   • CEncrypt all customer data in transit and at rest.
   • DImplement multi-factor authentication for all portal users.
   Reveal Solution Discussion Select an answer first