During a ransomware incident, the incident response team isolates affected systems and begins recovery from backups. The legal department requests that the team preserve evidence for potential litigation. The CEO pressures the team to restore systems as quickly as possible to minimize business disruption. Which action best balances the competing requirements?

Preserve forensic images of affected systems before restoration, then proceed with recovery.

Immediately restore all systems from backups to resume operations.

Ignore the legal request and focus solely on restoring operations.

Wait for the legal department to complete a full investigation before any restoration.

A financial services firm has experienced multiple phishing incidents despite annual security awareness training. The CISO wants to reduce the success rate of phishing attacks. Which approach is most likely to improve the effectiveness of the awareness program?

Replace the training with a one-time, mandatory computer-based course for all employees.

Disable email links and attachments for all employees to prevent phishing.

Increase the frequency of training to quarterly and include simulated phishing exercises.

Focus training only on new hires during onboarding.

Which risk assessment methodology is most appropriate when an organization needs to quickly categorize risks using subjective ratings such as high, medium, and low?

Annualized loss expectancy (ALE) calculation

GIAC Information Security Professional

Domain 1Objective 1

Security and Risk Management GISP Practice Questions (Page 4)

Part of the Security Management and Risk domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 12–20 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

14concepts

Questions 16–20

16expert · hard
During a ransomware incident, the incident response team isolates affected systems and begins recovery from backups. The legal department requests that the team preserve evidence for potential litigation. The CEO pressures the team to restore systems as quickly as possible to minimize business disruption. Which action best balances the competing requirements?
Select an answer first
17application · medium
A financial services firm has experienced multiple phishing incidents despite annual security awareness training. The CISO wants to reduce the success rate of phishing attacks. Which approach is most likely to improve the effectiveness of the awareness program?
Select an answer first
18foundation · easy
Which standard is specifically designed to protect cardholder data and applies to any organization that stores, processes, or transmits payment card information?
Select an answer first
19foundation · easy
Which security document is typically a high-level statement that reflects management's intent and provides the overall direction for security within an organization?
Select an answer first
20foundation · easy
Which risk assessment methodology is most appropriate when an organization needs to quickly categorize risks using subjective ratings such as high, medium, and low?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Security and Risk Management GISP Practice Questions (Page 4)

Questions 16–20

A financial services firm has experienced multiple phishing incidents despite annual security awareness training. The CISO wants to reduce the success rate of phishing attacks. Which approach is most likely to improve the effectiveness of the awareness program?

Which standard is specifically designed to protect cardholder data and applies to any organization that stores, processes, or transmits payment card information?

Which security document is typically a high-level statement that reflects management's intent and provides the overall direction for security within an organization?

Which risk assessment methodology is most appropriate when an organization needs to quickly categorize risks using subjective ratings such as high, medium, and low?

Keep studying — Security Management and Risk