A company is defining security roles and responsibilities. The CEO has asked the security team to ensure that all employees understand their role in protecting company data. Which responsibility should be assigned to the general user community?

Conducting annual risk assessments

Performing penetration tests on the network

Developing and enforcing security policies

Following security policies and reporting suspicious activity

A hospital is designing a new patient portal. The portal must allow patients to view their medical records online. The security team must balance the need for patient privacy with the need for patients to access their data. Which control best supports both confidentiality and availability?

Encrypting all data in the database

Restricting access to the portal to business hours only

Requiring patients to visit the hospital to view their records

Implementing multi-factor authentication for all patients

A company is implementing a new security policy that requires employees to use password managers. The policy also states that employees must not share passwords. The company has a culture of collaboration and some employees are resistant to the policy. What is the best way to encourage compliance?

Allow employees to opt out if they have been with the company for more than five years.

Immediately terminate employees who do not comply with the policy.

Involve employees in the policy development process and provide training on the benefits of password managers.

Implement the policy without any communication to avoid debate.

Which of the following is the primary purpose of a security awareness program?

To reduce human-related risks by changing user behavior and knowledge

To replace technical security controls with user vigilance

To test the effectiveness of security software

To enforce security policies through disciplinary action

GIAC Information Security Fundamentals

Domain 1Objective 3

Security Foundations and Awareness GISF Practice Questions (Page 6)

Part of the Foundations and Risk Management domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 26–30

26application · medium
A company is defining security roles and responsibilities. The CEO has asked the security team to ensure that all employees understand their role in protecting company data. Which responsibility should be assigned to the general user community?
Select an answer first
27application · medium
A hospital is evaluating risks to its patient portal. They determine that the risk of a data breach is low because of strong encryption, but the impact would be high due to regulatory fines. They decide to accept the risk because the cost of additional controls exceeds the potential fine. Which risk management strategy is this?
Select an answer first
28expert · hard
A hospital is designing a new patient portal. The portal must allow patients to view their medical records online. The security team must balance the need for patient privacy with the need for patients to access their data. Which control best supports both confidentiality and availability?
Select an answer first
29expert · hard
A company is implementing a new security policy that requires employees to use password managers. The policy also states that employees must not share passwords. The company has a culture of collaboration and some employees are resistant to the policy. What is the best way to encourage compliance?
Select an answer first
30foundation · easy
Which of the following is the primary purpose of a security awareness program?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.