Which of the following is a secure method for disposing of a hard drive that contained sensitive data?

Reformatting the drive with a quick format

Using a degausser to demagnetize the drive

Physically damaging the drive by dropping it

Deleting the files and emptying the recycle bin

A financial institution is migrating its on-premises data center to a public cloud. The compliance team requires that all data be retained for at least seven years, but the cloud provider's default storage class deletes objects after one year. The institution also needs to ensure that data is not accidentally deleted before the retention period ends. What is the best approach?

Set up a lifecycle policy to transition data to a cheaper storage class after one year

Use an object lock or WORM (write once, read many) storage feature to prevent deletion until the retention period expires

Rely on the cloud provider's backup service to restore deleted data

Store data in multiple regions to ensure redundancy

A mid-sized law firm recently discovered that several old laptops containing client case files were sold at an auction without being properly wiped. The firm's managing partner wants to prevent this from happening again. What is the most effective control to implement?

Create a policy that prohibits the sale of old laptops and requires them to be stored in a locked closet

Require IT to maintain an asset inventory and track each device through disposal, including a secure wipe certificate

Ask employees to delete sensitive files before returning their laptops

Purchase a new encryption tool and install it on all future laptops

A mid-sized company has an asset inventory that only includes servers and network equipment. The security team is planning to implement data loss prevention (DLP) controls. What is the most likely consequence of this incomplete inventory?

The DLP implementation will miss data stored on employee workstations and mobile devices.

The security team will need to purchase more DLP licenses than necessary.

The inventory will be sufficient because DLP is primarily a network control.

DLP controls will be more effective because they focus on critical infrastructure.

A large organization is implementing a data governance program. The data owners have been identified for each business unit, but the organization is struggling with data custodianship. The IT department is responsible for managing the infrastructure, but business units often use shadow IT solutions. What is the best way to ensure that all data has a designated custodian?

Eliminate all shadow IT solutions to ensure that IT has full control

Assign IT as the custodian for all data, including shadow IT solutions

Create a new role of 'data steward' to manage all data, including shadow IT

Require each business unit to designate a custodian for their data, including data stored in shadow IT

GIAC Information Security Professional

Domain 1Objective 2

Asset Security GISP Practice Questions (Page 5)

Part of the Security Management and Risk domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 12–20 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 21–25

21foundation · easy
Which of the following is a secure method for disposing of a hard drive that contained sensitive data?
Select an answer first
22expert · hard
A financial institution is migrating its on-premises data center to a public cloud. The compliance team requires that all data be retained for at least seven years, but the cloud provider's default storage class deletes objects after one year. The institution also needs to ensure that data is not accidentally deleted before the retention period ends. What is the best approach?
Select an answer first
23application · medium
A mid-sized law firm recently discovered that several old laptops containing client case files were sold at an auction without being properly wiped. The firm's managing partner wants to prevent this from happening again. What is the most effective control to implement?
Select an answer first
24application · medium
A mid-sized company has an asset inventory that only includes servers and network equipment. The security team is planning to implement data loss prevention (DLP) controls. What is the most likely consequence of this incomplete inventory?
Select an answer first
25expert · hard
A large organization is implementing a data governance program. The data owners have been identified for each business unit, but the organization is struggling with data custodianship. The IT department is responsible for managing the infrastructure, but business units often use shadow IT solutions. What is the best way to ensure that all data has a designated custodian?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Asset Security GISP Practice Questions (Page 5)

Questions 21–25

Which of the following is a secure method for disposing of a hard drive that contained sensitive data?

A mid-sized law firm recently discovered that several old laptops containing client case files were sold at an auction without being properly wiped. The firm's managing partner wants to prevent this from happening again. What is the most effective control to implement?

A mid-sized company has an asset inventory that only includes servers and network equipment. The security team is planning to implement data loss prevention (DLP) controls. What is the most likely consequence of this incomplete inventory?

Keep studying — Security Management and Risk