What is the purpose of applying data classification labels to information assets?

To identify the original author of the data for copyright purposes

To track the storage location of the data for backup purposes

To indicate the level of protection and handling required for the data

To determine the data's monetary value for financial reporting

An employee receives a phone call from someone claiming to be from the IT department, asking for their password to perform a 'security update'. The employee provides the password. What is the most effective control to prevent this type of incident?

Implement a policy that IT staff will never ask for passwords.

Deploy a technical control that blocks outbound calls to unknown numbers.

Disable the employee's account until they complete a refresher course.

Provide security awareness training on social engineering and phishing.

What is the primary responsibility of an asset custodian?

To use the asset in accordance with organizational policies

To approve access requests for the asset

To define the classification and handling requirements for the asset

To implement and maintain the security controls that protect the asset

A company is developing a new mobile app that collects user location data. The privacy team is concerned about compliance with privacy regulations. The app also needs to share location data with a third-party analytics provider. What is the most important privacy control to implement?

Encrypt the location data in transit and at rest.

Obtain explicit consent from users before collecting and sharing their location data.

Anonymize the location data before sharing it with the analytics provider.

Limit the collection of location data to only when the app is in use.

GIAC Information Security Professional

Domain 1Objective 2

Asset Security GISP Practice Questions (Page 1)

Part of the Security Management and Risk domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 12–20 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 1–5

1foundation · easy
What is the purpose of applying data classification labels to information assets?
Select an answer first
2application · medium
An employee receives a phone call from someone claiming to be from the IT department, asking for their password to perform a 'security update'. The employee provides the password. What is the most effective control to prevent this type of incident?
Select an answer first
3foundation · easy
What is the primary responsibility of an asset custodian?
Select an answer first
4application · medium
A regional hospital is implementing a new asset management program. The IT director wants to prioritize protection efforts based on the impact of a loss. The hospital has a patient records database, a building access control system, a staff training video library, and a lobby digital signage system. Which asset should be classified as highest criticality?
Select an answer first
5expert · hard
A company is developing a new mobile app that collects user location data. The privacy team is concerned about compliance with privacy regulations. The app also needs to share location data with a third-party analytics provider. What is the most important privacy control to implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.