An e-commerce company stores customer data in a cloud database. The company is subject to the GDPR and wants to ensure that customer data is protected. The database is encrypted at rest and in transit. What additional control is most important to comply with GDPR?

Store all customer data in the same region as the company's headquarters

Implement a process to respond to data subject access requests (DSARs) within the required timeframe

Encrypt the database with a stronger encryption algorithm

Obtain consent from customers once at the time of account creation

A hospital is replacing its MRI machines. The old machines contain hard drives with patient imaging data. The hospital plans to sell the machines to a medical equipment reseller. What is the most appropriate disposal method?

Reformat the hard drives and reinstall the operating system before selling

Delete the patient data files and then sell the machines

Sell the machines as-is and rely on the reseller to wipe the drives

Remove the hard drives and physically destroy them, then sell the machines without the drives

A company is required by law to retain financial records for 10 years. The records are stored in a cloud storage service. After 10 years, what should the company do with the records?

Securely delete the records and document the deletion.

Move the records to a cheaper storage tier and keep them for another 10 years.

Keep them indefinitely to avoid any legal issues.

Archive the records to tape and store them offsite.

A project team is creating a new customer relationship management (CRM) system. The team lead wants to ensure that data in the system is properly managed. Who should be assigned as the data owner for the CRM data?

The chief information officer, because they are responsible for all IT systems.

The project team lead, because they are leading the project.

The head of sales, because the CRM data is used by the sales department.

The database administrator, because they manage the technical environment.

What is the primary goal of information lifecycle management (ILM)?

To ensure all information is kept indefinitely for historical purposes

To maximize the number of copies of data stored across multiple locations

To reduce the cost of information storage by using only cloud services

To manage information from creation through disposal in a way that balances value and risk

GIAC Information Security Professional

Domain 1Objective 2

Asset Security GISP Practice Questions (Page 4)

Part of the Security Management and Risk domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 12–20 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 16–20

16application · medium
An e-commerce company stores customer data in a cloud database. The company is subject to the GDPR and wants to ensure that customer data is protected. The database is encrypted at rest and in transit. What additional control is most important to comply with GDPR?
Select an answer first
17application · medium
A hospital is replacing its MRI machines. The old machines contain hard drives with patient imaging data. The hospital plans to sell the machines to a medical equipment reseller. What is the most appropriate disposal method?
Select an answer first
18application · medium
A company is required by law to retain financial records for 10 years. The records are stored in a cloud storage service. After 10 years, what should the company do with the records?
Select an answer first
19application · medium
A project team is creating a new customer relationship management (CRM) system. The team lead wants to ensure that data in the system is properly managed. Who should be assigned as the data owner for the CRM data?
Select an answer first
20foundation · easy
What is the primary goal of information lifecycle management (ILM)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.