10 free GIAC Information Security Fundamentals GISF practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 316 questions. Work through them, then open each answer to check your reasoning.
Get all 316 questions (US$39) · Download these 10 as a PDF
Question 1
Your company is covered under a liability insurance policy, which provides various liability coverage for information security risks, including any physical damage of assets, hacking attacks, etc. Which of the following risk management techniques is your company using?
Show answer and explanation
Correct answer: B. Risk transfer
Risk transfer involves shifting the financial impact of a risk to a third party, typically through insurance. By obtaining liability insurance that covers information security risks including hacking attacks and physical damage, the company is transferring its risk exposure to the insurance provider. The company still faces the risk, but the financial burden is transferred.
Why the other options are wrong
- A. Risk acceptance means acknowledging the risk and choosing to absorb potential losses without mitigation or transfer.
- C. Risk avoidance involves eliminating the activity that creates the risk entirely.
- D. Risk mitigation involves implementing controls to reduce the likelihood or impact of a risk.
Question 2
You have successfully installed an IRM server into your environment. This IRM server will be utilized to protect the company's videos, which are available to all employees but contain sensitive data. You log on to the WSS 3.0 server with administrator permissions and navigate to the Operations section.
What option should you now choose so that you can input the RMS server name for the WSS 3.0 server to use?
Show answer and explanation
Correct answer: C. Information Rights Management
Information Rights Management (IRM) is the specific feature in SharePoint/WSS 3.0 that manages rights to protected content. To configure an IRM server for WSS 3.0, administrators navigate to the Operations section and select the Information Rights Management option, where they can input the RMS server name and configure IRM settings for the farm.
Why the other options are wrong
- A. Self-service site management controls user site creation permissions, not IRM configuration.
- B. Content databases are used to manage the databases that store SharePoint content, not to configure external services like RMS.
- D. Define managed paths is used to configure URL path inclusion/exclusion for managed content, not for IRM server settings.
Question 3
You work as a security manager for Qualxiss Inc. Your Company involves OODA loop for resolving and deciding over company issues. You have detected a security breach issue in your company.
Which of the following procedures regarding the breach is involved in the observe phase of the OODA loop?
Show answer and explanation
Correct answer: A. Follow the company security guidelines.
The Observe phase of the OODA loop is pure data collection: the manager watches the unfolding situation and gathers information through the established channels and controls already in place, which for a detected breach means working from the company security guidelines and documented reporting procedures. Analysis that draws on prior experience belongs to Orient, selecting a course of action belongs to Decide, and putting that action into effect belongs to Act. Because the question asks what happens while the breach is being observed, following the company security guidelines is the correct procedure.
Why the other options are wrong
- B. Choosing an activity based on a hypothesis is the Decide phase, where one option is selected from the alternatives produced by orientation.
- C. Implementing an action practically as policy is the Act phase, which executes the decision already made.
- D. Weighing previous experiences of security breaches is the Orient phase, where observed data is filtered through prior knowledge and analysis.
Question 4
How long are cookies in effect if no expiration date is set?
Show answer and explanation
Correct answer: B. Until the session ends.
Cookies without an explicit expiration date are session cookies that persist only for the duration of the browser session. Once the user closes their browser or the session ends, the cookie is automatically deleted. This is the default behavior for cookies that do not specify an expires or max-age attribute.
Why the other options are wrong
- A. Fifteen days is an arbitrary timeframe and not the standard default for session cookies.
- C. Cookies do not persist forever without an expiration date; session cookies are deleted when the session ends.
- D. One year would represent a persistent cookie with an explicit expiration date set, not the default behavior.
Question 5
You work as a Network Administrator for ABC Inc. The company has a secure wireless network.
However, in the last few days, an attack has been taking place over and over again. This attack is taking advantage of ICMP directed broadcast. To stop this attack, you need to disable ICMP directed broadcasts.
Which of the following attacks is taking place?
Show answer and explanation
Correct answer: A. Smurf attack
A Smurf attack exploits ICMP directed broadcasts to amplify denial-of-service attacks. The attacker sends ICMP Echo Request packets (ping) to a broadcast address, causing multiple hosts to reply to the victim's spoofed source address, overwhelming the target with traffic. Disabling ICMP directed broadcasts directly prevents this attack vector.
Why the other options are wrong
- B. Sniffer attacks involve capturing and analyzing network traffic; they are not related to ICMP directed broadcasts.
- C. Cryptographic attacks target encryption algorithms and keys, not ICMP protocols.
- D. FMS attacks target wireless encryption (related to WEP), not ICMP directed broadcasts.
Question 6
Which of the following statements are true about Dsniff?
Each correct answer represents a complete solution.
Choose two.
Show answer and explanation
Correct answer: B, D
B. It contains Trojans. D. It is a collection of various hacking tools. Dsniff is a suite of network auditing and penetration testing utilities that includes password sniffers, DNS spoofing tools, and man-in-the-middle programs such as sshmitm and webmitm. Several of its components behave as Trojans: they impersonate legitimate services to intercept credentials and traffic, and antivirus engines flag them as Trojan code for that reason. It is therefore both a collection of hacking tools and a package that contains Trojans.
Why the other options are wrong
- A. Dsniff does not self-replicate or infect host files, so it is not a virus.
- C. Dsniff provides no malware detection or removal capability, so it is not antivirus software.
Question 7
Which of the following are the goals of the cryptographic systems?
Each correct answer represents a complete solution.
Choose three.
Show answer and explanation
Correct answer: B, C, D
B. Authentication C. Confidentiality D. Integrity The primary goals of cryptographic systems are Authentication (verifying the identity of communicating parties), Confidentiality (keeping data secret from unauthorized parties), and Integrity (ensuring data has not been modified). These three pillars form the core of information security. Availability is primarily an operational security goal related to system uptime and accessibility, not a direct goal of cryptographic systems themselves.
Why the other options are wrong
- A. Availability relates to ensuring systems and data remain accessible, which is achieved through operational measures rather than cryptographic systems specifically.
Question 8
John works as an Exchange Administrator for Apple Inc. The company has a Windows 2003 Active Directory domain-based network. The network contains several Windows Server 2003 servers. Three of them have been configured as domain controllers. John complains to the Network Administrator that he is unable to manage group memberships.
Which of the following operations master roles is responsible for managing group memberships?
Show answer and explanation
Correct answer: B. Infrastructure master
The Infrastructure Master operations master role is responsible for managing object references across domains in Active Directory, which includes managing group memberships and updating group-to-user references. When users move between domains or when group membership changes need to be reflected across the directory, the Infrastructure Master handles these operations.
Why the other options are wrong
- A. The PDC Emulator manages password changes and time synchronization, not group memberships.
- C. The Schema Master controls schema modifications and updates to the Active Directory schema, not group membership management.
- D. The RID Master allocates Relative Identifiers to domain controllers for creating new security principals, not for managing group memberships.
Question 9
You are the project manager of SST project. You are in the process of collecting and distributing performance information including status report, progress measurements, and forecasts.
Which of the following process are you performing?
Show answer and explanation
Correct answer: C. Report Performance
Report Performance is the process of collecting, measuring, and distributing performance information to support status assessments, progress measurements, and performance forecasts. This process directly encompasses status reports, progress measurements, and forecasts, which are explicitly mentioned in the question. The project manager is fulfilling the core function of this monitoring and controlling process group activity.
Why the other options are wrong
- A. Perform Quality Control focuses on ensuring deliverables meet quality standards through inspection and testing, not on collecting and distributing performance information.
- B. Verify Scope is about obtaining formal acceptance of completed scope deliverables, not about performance reporting.
- D. Control Scope addresses preventing unauthorized scope changes and managing those that occur, not collecting performance data for reporting.
Question 10
John works as a Network Administrator for Perfect Solutions Inc. The company has a Linux-based network. The company is aware of various types of security attacks and wants to impede them. Hence, management has assigned John a project to port scan the company's Web Server. For this, he uses the nmap port scanner and issues the following command to perform idle port scanning:
nmap -PN -p- -sI IP_Address_of_Company_Server He analyzes that the server's TCP ports 21, 25, 80, and 111 are open.
Which of the following security policies is the company using during this entire process to mitigate the risk of hacking attacks?
Show answer and explanation
Correct answer: A. Audit policy
An Audit policy is the security framework that enables authorized security testing, vulnerability assessments, and port scanning activities. The scenario describes management-authorized penetration testing to identify and mitigate security risks, which is a core component of an audit policy that allows technical staff to assess network vulnerabilities in a controlled manner to prevent attacks.
Why the other options are wrong
- B. Antivirus policy specifically addresses malware protection mechanisms, not vulnerability assessment through port scanning.
- C. A non-disclosure agreement is a legal contract protecting confidential information, not a security policy for vulnerability testing.
- D. Acceptable use policy governs employee conduct and appropriate use of systems and resources, not security testing procedures.
That was 10 of 316.
The full GIAC Information Security Fundamentals GISF pack has all 316 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.