A company is performing a risk assessment for its new cloud-based customer relationship management (CRM) system. They have identified that the risk of a data breach is moderate. Which step should they take next in the risk management process?

Transfer the risk to a third party without further analysis

Evaluate the likelihood and impact of the risk to determine its level

Immediately implement all possible security controls

A company is planning its security awareness training for the year. The training must cover topics that address the most common human-related risks. Which combination of topics should be included?

Firewall configuration, intrusion detection, and penetration testing

Data backup, disaster recovery, and business continuity

Phishing, password hygiene, and social engineering

Cryptography, network protocols, and operating system hardening

GIAC Information Security Fundamentals

Domain 1Objective 3

Security Foundations and Awareness GISF Practice Questions (Page 4)

Part of the Foundations and Risk Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 16–20

16foundation · easy
Which step in the risk management process involves determining the likelihood and potential impact of identified risks?
Select an answer first
17foundation · easy
An organization implements file hashing to verify that a downloaded software update has not been modified during transmission. Which CIA triad principle is this primarily supporting?
Select an answer first
18application · medium
A company is performing a risk assessment for its new cloud-based customer relationship management (CRM) system. They have identified that the risk of a data breach is moderate. Which step should they take next in the risk management process?
Select an answer first
19application · medium
A company is planning its security awareness training for the year. The training must cover topics that address the most common human-related risks. Which combination of topics should be included?
Select an answer first
20foundation · easy
Which document provides the specific, step-by-step actions required to implement a security policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Security Foundations and Awareness GISF Practice Questions (Page 4)

Questions 16–20

Which step in the risk management process involves determining the likelihood and potential impact of identified risks?

An organization implements file hashing to verify that a downloaded software update has not been modified during transmission. Which CIA triad principle is this primarily supporting?

A company is performing a risk assessment for its new cloud-based customer relationship management (CRM) system. They have identified that the risk of a data breach is moderate. Which step should they take next in the risk management process?

A company is planning its security awareness training for the year. The training must cover topics that address the most common human-related risks. Which combination of topics should be included?

Which document provides the specific, step-by-step actions required to implement a security policy?

Keep studying — Foundations and Risk Management