A regional hospital is implementing a new asset management program. The CIO wants to prioritize security investments based on the impact of a loss. The IT manager has a list of all networked devices, but the list does not indicate which systems support patient care directly. What should the IT manager do first to support the CIO's goal?

Assign each device a classification label based on the sensitivity of the data it stores.

Purchase additional security monitoring tools for all devices to ensure equal protection.

Identify which devices are essential to patient care processes and mark them as high criticality.

Replace the asset list with a new inventory that only includes servers and network equipment.

A global company must comply with both GDPR and a local data residency law that requires certain data to remain within the country. The company uses a cloud provider that offers multiple regions. What is the most appropriate approach?

Encrypt the data and store it in any region, because encryption satisfies both GDPR and data residency laws.

Store the data in a cloud region located within the required country and ensure the provider offers contractual guarantees for data residency.

Store the data on-premises in the required country to avoid any cloud-related compliance issues.

Use a cloud provider that is certified for GDPR and ignore the local data residency law.

Which of the following is an example of a data handling procedure that should be defined for each classification level?

Choosing the color scheme for the data's user interface

Selecting the software application used to create the data

Specifying the encryption requirements for data at rest and in transit

Determining the data's storage format (e.g., PDF vs. DOCX)

A hospital is implementing a new asset management system. They need to classify a database that contains patient health records, a server that hosts the hospital's public website, and a printer in the administrative office. Which asset should be classified as the highest criticality?

The public website server, because it is accessible from the internet.

All assets should have the same criticality to simplify management.

The patient health records database, because its loss would severely impact patient care and legal compliance.

The administrative printer, because it is used daily.

A software development company has a mix of laptops, servers, and cloud-based virtual machines. The security team is struggling to keep track of all assets because some are purchased by individual departments and not reported. What is the best way to improve asset visibility?

Require each department to maintain its own spreadsheet of assets

Conduct a physical inventory once a year

Only track assets that are connected to the corporate network

Implement a centralized asset management system that integrates with procurement and cloud provider APIs

GIAC Information Security Professional

Domain 1Objective 2

Asset Security GISP Practice Questions (Page 6)

Part of the Security Management and Risk domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 12–20 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 26–30

26application · medium
A regional hospital is implementing a new asset management program. The CIO wants to prioritize security investments based on the impact of a loss. The IT manager has a list of all networked devices, but the list does not indicate which systems support patient care directly. What should the IT manager do first to support the CIO's goal?
Select an answer first
27expert · hard
A global company must comply with both GDPR and a local data residency law that requires certain data to remain within the country. The company uses a cloud provider that offers multiple regions. What is the most appropriate approach?
Select an answer first
28foundation · easy
Which of the following is an example of a data handling procedure that should be defined for each classification level?
Select an answer first
29application · medium
A hospital is implementing a new asset management system. They need to classify a database that contains patient health records, a server that hosts the hospital's public website, and a printer in the administrative office. Which asset should be classified as the highest criticality?
Select an answer first
30application · medium
A software development company has a mix of laptops, servers, and cloud-based virtual machines. The security team is struggling to keep track of all assets because some are purchased by individual departments and not reported. What is the best way to improve asset visibility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.