A retail company collects customer data including names, addresses, and purchase history. The marketing department wants to share this data with a third-party analytics firm. The legal team has determined that the data is not subject to any specific regulation but is considered sensitive by the company. What should the company do before sharing the data?

Obtain written consent from each customer before sharing

Encrypt the data before sharing it with the analytics firm

Anonymize the data so that individuals cannot be identified

Share the data as-is because no regulation applies

A financial services firm discovers that several decommissioned laptops were sold to a third-party recycler without removing the hard drives. The firm's asset inventory shows these laptops as 'disposed' but does not record the method of disposal. What is the most immediate risk this situation presents?

The recycler may resell the laptops, causing the firm to lose track of its hardware assets.

The laptops may still be under warranty, and the recycler could claim repair costs.

The firm will be unable to calculate the residual value of the laptops for tax purposes.

The hard drives may still contain sensitive data that could be recovered by unauthorized parties.

What is the primary purpose of implementing measures to protect personally identifiable information (PII)?

To enhance the usability of applications for end users

To reduce the cost of data storage by minimizing the amount of PII collected

To comply with privacy regulations and prevent unauthorized access or disclosure of PII

To enable marketing departments to use customer data more effectively

A legal department requires that all contract documents be retained for seven years after the contract ends. An administrator is configuring an email archiving system. What is the most appropriate action to support this requirement?

Store contract emails in a separate folder and let the administrator manually delete them after seven years.

Retain all emails indefinitely to avoid missing any contract documents.

Apply a retention policy to emails that contain contract documents, keeping them for seven years.

Set the archive to automatically delete all emails after seven years.

GIAC Information Security Professional

Domain 1Objective 2

Asset Security GISP Practice Questions (Page 2)

Part of the Security Management and Risk domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 12–20 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 6–10

6foundation · easy
In the context of asset ownership, which role is ultimately responsible for ensuring that an asset is protected and that its classification is correct?
Select an answer first
7application · medium
A retail company collects customer data including names, addresses, and purchase history. The marketing department wants to share this data with a third-party analytics firm. The legal team has determined that the data is not subject to any specific regulation but is considered sensitive by the company. What should the company do before sharing the data?
Select an answer first
8application · medium
A financial services firm discovers that several decommissioned laptops were sold to a third-party recycler without removing the hard drives. The firm's asset inventory shows these laptops as 'disposed' but does not record the method of disposal. What is the most immediate risk this situation presents?
Select an answer first
9foundation · easy
What is the primary purpose of implementing measures to protect personally identifiable information (PII)?
Select an answer first
10application · medium
A legal department requires that all contract documents be retained for seven years after the contract ends. An administrator is configuring an email archiving system. What is the most appropriate action to support this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Asset Security GISP Practice Questions (Page 2)

Questions 6–10

In the context of asset ownership, which role is ultimately responsible for ensuring that an asset is protected and that its classification is correct?

What is the primary purpose of implementing measures to protect personally identifiable information (PII)?

A legal department requires that all contract documents be retained for seven years after the contract ends. An administrator is configuring an email archiving system. What is the most appropriate action to support this requirement?

Keep studying — Security Management and Risk