A company is implementing an IAM solution. They want to ensure that users have the minimum access necessary to perform their jobs. They also want to ensure that access is reviewed regularly. Which combination of practices best achieves this?

Implement role-based access control (RBAC) and conduct periodic access reviews

Use a single account for all users and review annually

Grant all users administrative access and review quarterly

Rely on the initial access request and never review

A hospital is implementing an IAM system for its staff. The system must ensure that a nurse can access patient records only during their shift and only for patients assigned to their ward. Which combination of IAM concepts should be applied?

Mandatory access control (MAC) with labels for all patients and staff

Discretionary access control (DAC) where each nurse sets permissions on patient records

Single sign-on (SSO) with no additional authorization checks

Role-based access control (RBAC) with time-based restrictions and attribute-based conditions for ward assignment

A company is setting up a remote access solution for employees working from home. They want to ensure that the connection is encrypted and that only authorized employees can access the internal network. Which combination of technologies should they use?

VPN with IPsec or TLS and multi-factor authentication (MFA)

A web portal with a simple username and password

Remote Desktop Protocol (RDP) directly exposed to the internet

A dedicated leased line for each employee

A company is implementing a secure email solution. They need to ensure that an email message has not been altered in transit and that it truly originated from the claimed sender. Which cryptographic technique should be used?

Use a message authentication code (MAC) with a shared secret

Use a symmetric key to encrypt the message and send the key separately

Encrypt the message with the recipient's public key

Hash the message and encrypt the hash with the sender's private key

GIAC Information Security Professional

Domain 2Objective 1

Security Architecture and Engineering GISP Practice Questions (Page 3)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

12concepts

Questions 11–15

11expert · hard
A company is implementing an IAM solution. They want to ensure that users have the minimum access necessary to perform their jobs. They also want to ensure that access is reviewed regularly. Which combination of practices best achieves this?
Select an answer first
12application · medium
A hospital is implementing an IAM system for its staff. The system must ensure that a nurse can access patient records only during their shift and only for patients assigned to their ward. Which combination of IAM concepts should be applied?
Select an answer first
13foundation · easy
Which assurance method involves mathematically proving that a system meets its security specifications?
Select an answer first
14application · medium
A company is setting up a remote access solution for employees working from home. They want to ensure that the connection is encrypted and that only authorized employees can access the internal network. Which combination of technologies should they use?
Select an answer first
15application · medium
A company is implementing a secure email solution. They need to ensure that an email message has not been altered in transit and that it truly originated from the claimed sender. Which cryptographic technique should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.