What is the primary purpose of a security policy in an organization?

To list the specific software products that must be used

To define mandatory technical configurations for all systems

To provide high-level direction and management intent for security

To provide step-by-step instructions for performing a specific task

A company is designing a security awareness program. The goal is to reduce the likelihood of employees falling for social engineering attacks. Which approach is most effective?

Posting security posters in common areas

Conducting a one-time training session at onboarding

Requiring employees to read the security policy annually

Sending monthly simulated phishing emails and providing immediate feedback

A university is experiencing an increase in social engineering attacks targeting faculty members. The IT security team wants to reduce the success of these attacks. Which measure should they implement first?

Install more firewalls to block malicious traffic.

Disable all external email communication for faculty.

Conduct a security awareness campaign that includes recognizing social engineering tactics.

Purchase cyber insurance to cover losses from social engineering.

GIAC Information Security Fundamentals

Domain 1Objective 3

Security Foundations and Awareness GISF Practice Questions (Page 5)

Part of the Foundations and Risk Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 21–25

21foundation · easy
What is the primary purpose of a security policy in an organization?
Select an answer first
22application · medium
A company is designing a security awareness program. The goal is to reduce the likelihood of employees falling for social engineering attacks. Which approach is most effective?
Select an answer first
23application · medium
An e-commerce company stores customer credit card numbers in a database. To protect this data, they implement encryption at rest and in transit. Which security goal is primarily being addressed?
Select an answer first
24application · medium
A small manufacturing company is conducting a risk assessment. They have identified that a failure of the cooling system in the server room could cause servers to overheat and shut down, leading to a production outage. The company decides to install a backup cooling unit that automatically activates if the primary unit fails. Which risk management strategy are they applying?
Select an answer first
25application · medium
A university is experiencing an increase in social engineering attacks targeting faculty members. The IT security team wants to reduce the success of these attacks. Which measure should they implement first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Security Foundations and Awareness GISF Practice Questions (Page 5)

Questions 21–25

What is the primary purpose of a security policy in an organization?

A company is designing a security awareness program. The goal is to reduce the likelihood of employees falling for social engineering attacks. Which approach is most effective?

An e-commerce company stores customer credit card numbers in a database. To protect this data, they implement encryption at rest and in transit. Which security goal is primarily being addressed?

A university is experiencing an increase in social engineering attacks targeting faculty members. The IT security team wants to reduce the success of these attacks. Which measure should they implement first?

Keep studying — Foundations and Risk Management