A company relies on a single supplier for a critical component. The supplier has experienced financial difficulties, and there is a risk of supply disruption. The company's risk appetite is low. The cost of finding and qualifying a second supplier is high, but the cost of a disruption is even higher. Which risk response strategy is most appropriate?

Accept the risk because the supplier has been reliable for many years.

Mitigate the risk by developing a second supplier source, even though it is costly.

Avoid the risk by discontinuing the product that uses the component.

Transfer the risk by purchasing business interruption insurance.

What is the primary objective of a security awareness program?

To enforce security policies through disciplinary actions

To test the effectiveness of security controls

To change employee behavior and reduce security risks

To provide technical training for IT staff

A hospital is updating its disaster recovery plan. The hospital's electronic health record (EHR) system has an RTO of 4 hours and an RPO of 15 minutes. The current backup strategy performs full backups nightly and transaction log backups every 30 minutes. The hospital is considering a new backup solution that would reduce the RPO to 5 minutes but would increase the RTO to 6 hours. Which decision is most appropriate?

Reject the new solution because it does not meet the RTO requirement.

Adopt the new solution because a lower RPO is always better.

Use the new solution for non-critical systems and keep the current solution for the EHR.

Accept the new solution and update the RTO to 6 hours.

A small company has a single IT administrator who also serves as the security officer. The administrator has the ability to approve their own access requests and change audit logs. The company is preparing for a compliance audit. Which of the following is the most important control to implement?

Purchase cyber liability insurance to cover potential losses from insider misuse.

Increase the frequency of password changes for the administrator account.

Implement a separation of duties by having a second person review and approve the administrator's access changes.

Require the administrator to use a separate account for administrative tasks.

Which of the following is an example of a security metric used to measure the effectiveness of a security awareness program?

Time to patch critical vulnerabilities

Number of security policies written

Percentage of employees who complete security awareness training

GIAC Information Security Professional

Domain 1Objective 1

Security and Risk Management GISP Practice Questions (Page 8)

Part of the Security Management and Risk domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 12–20 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

14concepts

Questions 36–40

36expert · hard
A company relies on a single supplier for a critical component. The supplier has experienced financial difficulties, and there is a risk of supply disruption. The company's risk appetite is low. The cost of finding and qualifying a second supplier is high, but the cost of a disruption is even higher. Which risk response strategy is most appropriate?
Select an answer first
37foundation · easy
What is the primary objective of a security awareness program?
Select an answer first
38expert · hard
A hospital is updating its disaster recovery plan. The hospital's electronic health record (EHR) system has an RTO of 4 hours and an RPO of 15 minutes. The current backup strategy performs full backups nightly and transaction log backups every 30 minutes. The hospital is considering a new backup solution that would reduce the RPO to 5 minutes but would increase the RTO to 6 hours. Which decision is most appropriate?
Select an answer first
39application · medium
A small company has a single IT administrator who also serves as the security officer. The administrator has the ability to approve their own access requests and change audit logs. The company is preparing for a compliance audit. Which of the following is the most important control to implement?
Select an answer first
40foundation · easy
Which of the following is an example of a security metric used to measure the effectiveness of a security awareness program?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Security and Risk Management GISP Practice Questions (Page 8)

Questions 36–40

What is the primary objective of a security awareness program?

A small company has a single IT administrator who also serves as the security officer. The administrator has the ability to approve their own access requests and change audit logs. The company is preparing for a compliance audit. Which of the following is the most important control to implement?

Which of the following is an example of a security metric used to measure the effectiveness of a security awareness program?

Keep studying — Security Management and Risk