A company is evaluating a new software vendor that will have access to its customer database. The vendor's security questionnaire reveals that they do not perform background checks on employees who will have access to the data. Which of the following is the most appropriate risk treatment?

Mitigate the risk by requiring the vendor to implement background checks as a contractual condition.

Transfer the risk by purchasing cyber insurance that covers vendor-caused breaches.

Accept the risk because the vendor is well-known and has been in business for 20 years.

Avoid the risk by terminating the contract with the vendor immediately.

A company's security operations center (SOC) detects unusual outbound traffic from a server that normally does not communicate externally. The SOC analyst confirms the traffic is malicious and isolates the server. According to the incident management lifecycle, what is the next step the SOC should take?

Conduct a lessons-learned review to document what went wrong.

Immediately notify the public relations team to prepare a press release.

Restore the server from the last known good backup.

Begin eradication by removing the malicious files and closing the attack vector.

During a ransomware incident, a company's incident response team isolates affected systems. The isolation prevents the ransomware from spreading, but it also stops a critical business application that is needed for customer orders. The CEO demands that the systems be brought back online immediately. Which action is most appropriate?

Restore the systems immediately to resume business operations.

Bring the systems back online but only for read-only access.

Keep the systems isolated and explain to the CEO the risk of re-infection if they are brought back online prematurely.

Disconnect the systems from the network but allow local access to continue operations.

What is the primary purpose of classifying information assets?

To track the physical location of all assets

To reduce the total cost of asset ownership

To determine the level of protection required based on the asset's value and sensitivity

To assign ownership and ensure accountability for each asset

GIAC Information Security Professional

Domain 1Objective 1

Security and Risk Management GISP Practice Questions (Page 1)

Part of the Security Management and Risk domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 12–20 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

14concepts

Questions 1–5

1application · medium
A company is evaluating a new software vendor that will have access to its customer database. The vendor's security questionnaire reveals that they do not perform background checks on employees who will have access to the data. Which of the following is the most appropriate risk treatment?
Select an answer first
2foundation · easy
Which law or regulation is specifically designed to protect the privacy of personal data of individuals in the European Union and imposes requirements on organizations that process such data?
Select an answer first
3application · medium
A company's security operations center (SOC) detects unusual outbound traffic from a server that normally does not communicate externally. The SOC analyst confirms the traffic is malicious and isolates the server. According to the incident management lifecycle, what is the next step the SOC should take?
Select an answer first
4expert · hard
During a ransomware incident, a company's incident response team isolates affected systems. The isolation prevents the ransomware from spreading, but it also stops a critical business application that is needed for customer orders. The CEO demands that the systems be brought back online immediately. Which action is most appropriate?
Select an answer first
5foundation · easy
What is the primary purpose of classifying information assets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Security and Risk Management GISP Practice Questions (Page 1)

Questions 1–5

A company is evaluating a new software vendor that will have access to its customer database. The vendor's security questionnaire reveals that they do not perform background checks on employees who will have access to the data. Which of the following is the most appropriate risk treatment?

Which law or regulation is specifically designed to protect the privacy of personal data of individuals in the European Union and imposes requirements on organizations that process such data?

What is the primary purpose of classifying information assets?

Keep studying — Security Management and Risk