A financial services firm is updating its business continuity plan (BCP). The firm has identified that its trading platform must be restored within 15 minutes of a disruption to avoid significant financial loss. The current recovery time objective (RTO) for the platform is 2 hours. Which of the following actions is most directly aligned with closing this gap?

Deploy a hot standby environment that can be activated in under 15 minutes.

Revise the business impact analysis to accept a 2-hour RTO.

Increase the frequency of full backups from daily to hourly.

Negotiate a new maintenance contract with the hardware vendor for faster replacement parts.

A manufacturing company's business continuity plan designates a recovery time objective (RTO) of 4 hours for its order management system. During a recent tabletop exercise, the IT team discovered that the backup tapes are stored offsite but the restoration process takes 6 hours. The company's risk appetite allows for up to 8 hours of downtime for this system. Which action best aligns the BCP with the company's risk appetite?

Increase the frequency of backups to reduce the recovery point objective (RPO).

Invest in faster restoration technology or procedures to meet the 4-hour RTO.

Accept the 6-hour restoration time because it is within the 8-hour risk appetite.

Update the RTO to 8 hours to match the actual restoration capability.

What is the primary purpose of security metrics in an organization?

To automate all security responses

To measure the effectiveness of security controls and processes

To guarantee that no security incidents will occur

To replace the need for security audits

A retail company has experienced multiple phishing incidents despite annual security awareness training. The security team wants to improve the program. Which approach is most likely to reduce the number of employees who fall for phishing simulations?

Conduct monthly phishing simulations and provide immediate, personalized feedback to those who click.

Require all employees to sign an acceptable use policy that prohibits clicking on suspicious links.

Publish a monthly newsletter with examples of recent phishing emails.

Increase the length of the annual training video from 30 minutes to 2 hours.

Which phase of the incident management lifecycle involves actions taken to prevent future incidents and improve the incident response process?

Containment, eradication, and recovery

GIAC Information Security Professional

Domain 1Objective 1

Security and Risk Management GISP Practice Questions (Page 9)

Part of the Security Management and Risk domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~24–40 in this domain), expect 12–20 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

14concepts

Questions 41–45

41application · medium
A financial services firm is updating its business continuity plan (BCP). The firm has identified that its trading platform must be restored within 15 minutes of a disruption to avoid significant financial loss. The current recovery time objective (RTO) for the platform is 2 hours. Which of the following actions is most directly aligned with closing this gap?
Select an answer first
42expert · hard
A manufacturing company's business continuity plan designates a recovery time objective (RTO) of 4 hours for its order management system. During a recent tabletop exercise, the IT team discovered that the backup tapes are stored offsite but the restoration process takes 6 hours. The company's risk appetite allows for up to 8 hours of downtime for this system. Which action best aligns the BCP with the company's risk appetite?
Select an answer first
43foundation · easy
What is the primary purpose of security metrics in an organization?
Select an answer first
44application · medium
A retail company has experienced multiple phishing incidents despite annual security awareness training. The security team wants to improve the program. Which approach is most likely to reduce the number of employees who fall for phishing simulations?
Select an answer first
45foundation · easy
Which phase of the incident management lifecycle involves actions taken to prevent future incidents and improve the incident response process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Security and Risk Management GISP Practice Questions (Page 9)

Questions 41–45

What is the primary purpose of security metrics in an organization?

A retail company has experienced multiple phishing incidents despite annual security awareness training. The security team wants to improve the program. Which approach is most likely to reduce the number of employees who fall for phishing simulations?

Which phase of the incident management lifecycle involves actions taken to prevent future incidents and improve the incident response process?

Keep studying — Security Management and Risk