An organization is creating a security policy for remote work. The policy must address the protection of sensitive data on employee laptops. Which requirement should be included?

Laptops should be kept in a safe place when not in use.

Employees must report any security incidents to their manager.

All laptops must have full-disk encryption enabled.

Employees should avoid working on sensitive data at home.

A company is evaluating risks to its customer database. The database contains sensitive personal information. The company has a limited budget for security controls. Which approach best balances risk and cost?

Transferring all risk to a cyber insurance policy

Accepting the risk because the budget is limited

Conducting a cost-benefit analysis to prioritize controls that reduce the highest risks

Implementing all possible security controls regardless of cost

A company is defining the responsibilities of its security team. Which task is the security team primarily responsible for?

Approving all new software purchases

Ensuring that all employees complete annual security training

Monitoring network traffic for suspicious activity

Setting the organization's risk appetite

A company is developing a security policy for third-party vendors. The policy must ensure that vendors protect the company's data. However, the company also wants to maintain good relationships with vendors and avoid excessive burden. Which approach best balances these concerns?

Require vendors to purchase cyber insurance as the only security requirement.

Impose the same security controls on all vendors regardless of the data they handle.

Trust vendors to follow their own security practices without oversight.

Require all vendors to sign a contract that includes security requirements and conduct periodic audits.

What is the primary security responsibility of an end user in an organization?

To configure and maintain network firewalls

To follow security policies and report suspicious activity

To conduct regular vulnerability assessments

GIAC Information Security Fundamentals

Domain 1Objective 3

Security Foundations and Awareness GISF Practice Questions (Page 3)

Part of the Foundations and Risk Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 11–15

11application · medium
An organization is creating a security policy for remote work. The policy must address the protection of sensitive data on employee laptops. Which requirement should be included?
Select an answer first
12expert · hard
A company is evaluating risks to its customer database. The database contains sensitive personal information. The company has a limited budget for security controls. Which approach best balances risk and cost?
Select an answer first
13application · medium
A company is defining the responsibilities of its security team. Which task is the security team primarily responsible for?
Select an answer first
14expert · hard
A company is developing a security policy for third-party vendors. The policy must ensure that vendors protect the company's data. However, the company also wants to maintain good relationships with vendors and avoid excessive burden. Which approach best balances these concerns?
Select an answer first
15foundation · easy
What is the primary security responsibility of an end user in an organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.