What is the primary purpose of third-party risk management (TPRM)?

To transfer all security risks to third-party vendors

To reduce the cost of third-party services

To ensure that third parties are compliant with all international laws

To ensure that vendors and partners do not introduce unacceptable security risks to the organization

What is the primary purpose of security governance in an organization?

To develop and deploy security awareness training

To implement specific security controls and technologies

To align security management with business goals and regulatory requirements

To monitor network traffic for intrusions

Which term refers to the maximum amount of time that a business process can be unavailable before its recovery becomes impossible or unacceptable?

Maximum Tolerable Downtime (MTD)

An organization is defining security roles and responsibilities. The goal is to ensure accountability for security decisions and actions. Which assignment of responsibilities is most effective?

Assign security responsibilities to each employee based on their role and the principle of least privilege.

Make the IT department responsible for all security tasks.

Outsource all security responsibilities to a managed security service provider.

Assign the CISO sole responsibility for all security decisions.

GIAC Information Security Professional

Domain 1Objective 1

Security and Risk Management GISP Practice Questions (Page 2)

Part of the Security Management and Risk domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 12–20 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

14concepts

Questions 6–10

6foundation · easy
What is the primary purpose of third-party risk management (TPRM)?
Select an answer first
7foundation · easy
When an organization decides to discontinue a business process because the associated risk is too high, which risk response strategy is being applied?
Select an answer first
8foundation · easy
What is the primary purpose of security governance in an organization?
Select an answer first
9foundation · easy
Which term refers to the maximum amount of time that a business process can be unavailable before its recovery becomes impossible or unacceptable?
Select an answer first
10application · medium
An organization is defining security roles and responsibilities. The goal is to ensure accountability for security decisions and actions. Which assignment of responsibilities is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.