An organization is moving to a new office and needs to dispose of old filing cabinets that contain paper records with customer information. What is the most appropriate disposal method?

Recycle the paper records with other office paper.

Burn the records in an open fire.

Place the records in regular trash bins for pickup.

Shred the paper records using a cross-cut shredder.

A bank is required by law to retain customer transaction records for five years. After that period, the records must be destroyed. The bank's current system stores all records indefinitely because the IT team is unsure how to identify records older than five years. What is the best solution?

Keep all records indefinitely to avoid any risk of non-compliance

Delete all records older than five years without any review

Implement an automated retention policy that tags records with creation dates and deletes them after five years

Manually review records every year and delete those older than five years

Which of the following is the primary purpose of classifying assets in an organization?

To track the physical location of all assets in the organization

To assign a monetary value to each asset for insurance purposes

To identify which employees should have access to each asset

To determine the appropriate level of protection and handling required for each asset

A data owner has approved access to a sensitive database for a new employee. The database administrator (DBA) is responsible for granting the access. However, the DBA is on leave, and the employee needs access urgently. What is the most appropriate action?

Give the employee the DBA's credentials to access the database.

Have the data owner grant the access directly to the database.

Wait until the DBA returns to grant access, even if it delays the employee's work.

Grant the access temporarily and document it for review when the DBA returns.

GIAC Information Security Professional

Domain 1Objective 2

Asset Security GISP Practice Questions (Page 9)

Part of the Security Management and Risk domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 12–20 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 41–45

41application · medium
An organization is moving to a new office and needs to dispose of old filing cabinets that contain paper records with customer information. What is the most appropriate disposal method?
Select an answer first
42application · medium
A bank is required by law to retain customer transaction records for five years. After that period, the records must be destroyed. The bank's current system stores all records indefinitely because the IT team is unsure how to identify records older than five years. What is the best solution?
Select an answer first
43foundation · easy
Which of the following is the primary purpose of classifying assets in an organization?
Select an answer first
44expert · hard
A data owner has approved access to a sensitive database for a new employee. The database administrator (DBA) is responsible for granting the access. However, the DBA is on leave, and the employee needs access urgently. What is the most appropriate action?
Select an answer first
45foundation · easy
Which phase of the information lifecycle involves securely deleting data that is no longer needed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.