GFACT Practice Exam 2026/2027 • GIAC Foundational Cybersecurity Technologies • Unofficial Study Aid
GFACT CERTIFICATION EXAM 2026/2027 NEWEST VERSION
ACTUAL 160Q&A FREQUENTLY TESTED Q&A
GIAC Foundational Cybersecurity Technologies — Practice Exam | 160 Questions with Detailed Rationales
IMPORTANT DISCLAIMER: This document is an independent, original PRACTICE exam created to help candidates study the GFACT
domains as published in the GIAC GFACT Exam Objectives. It is NOT affiliated with, endorsed by, or sourced from GIAC/SANS, and does
NOT contain actual GIAC exam questions ("brain dumps"). GIAC exams are confidential and protected. Use this practice test solely to
assess your understanding of foundational cybersecurity principles.
The GIAC Foundational Cybersecurity Technologies (GFACT) certification validates foundational knowledge
essential for any cybersecurity role. This practice exam mirrors the style, breadth, and difficulty of the
GFACT domains, covering information security fundamentals, networking, operating systems, cryptography,
security controls, cloud, data protection, incident response, and governance/compliance to help you identify
strengths and focus your study for the 2026/2027 objectives.
Instructions: Select the best answer for each scenario. The correct answer is highlighted in bold cyan. Each question
includes a 2–3 sentence rationale explaining the correct choice and why distractors are incorrect. Aim to complete the 160
questions under timed, exam-like conditions and review rationales thoroughly.
Section 1: Brief Introduction
Section 2: The Complete Exam
Domains covered: Information Security Fundamentals • Networking Fundamentals • Operating Systems • Cybersecurity Concepts •
Cryptography • Security Controls • Cloud Computing • Data Security • Incident Response • Security Policies & Compliance | Time:
Simulate 4 hours | Passing guidance: Review rationales, not just scores.
1. A financial analyst sends a confidential earnings report via email without encryption, and it is
intercepted in transit. Which CIA triad principle was primarily violated?
A. Non-repudiation
B. Integrity
C. Availability
D. Confidentiality
Rationale: Confidentiality prevents unauthorized disclosure. The interception exposed sensitive data
without authorization, while integrity concerns alteration and availability concerns access; non-
repudiation is about proving origin.
2. A hospital's database log shows that a checksum mismatch was detected after a power failure,
indicating records were altered. Which CIA principle is directly affected?
A. Integrity
B. Availability
C. Authentication
D. Confidentiality
Rationale: Integrity ensures data remains accurate and unaltered. A checksum mismatch signals
unauthorized or accidental modification, whereas confidentiality is about disclosure and availability
is about uptime.
Confidential Study Use Only — Not Affiliated with or Endorsed by GIAC/SANS — Does Not Contain Actual Exam Content
, GFACT Practice Exam 2026/2027 • GIAC Foundational Cybersecurity Technologies • Unofficial Study Aid
3. A retail website experiences a DDoS attack that makes the checkout page unreachable for 4
hours. Which CIA principle is compromised?
A. Availability
B. Authorization
C. Integrity
D. Confidentiality
Rationale: Availability ensures authorized users can access systems when needed. The DDoS
disrupted service; confidentiality and integrity were not directly violated.
4. A user successfully logs in with username and password, then the system checks whether their
role permits access to the payroll folder. What is this second step called?
A. Attestation
B. Authentication
C. Authorization
D. Accounting
Rationale: Authentication verifies identity, while authorization enforces what an authenticated
identity is allowed to do. Accounting (auditing) tracks actions after access.
5. An organization requires employees to use badge + PIN to enter the data center. This is an
example of:
A. Federated identity
B. Single sign-on
C. Multi-factor authentication
D. Single-factor authentication
Rationale: MFA requires two or more factor categories (something you have = badge, something you
know = PIN). Single-factor uses one, SSO and federation concern access across systems.
6. After a contract is signed digitally, the signer cannot later deny having signed it because the
signature is cryptographically tied to them. Which principle does this demonstrate?
A. Non-repudiation
B. Availability
C. Least privilege
D. Confidentiality
Rationale: Non-repudiation provides proof of origin/integrity so an actor cannot deny an action.
Digital signatures provide this, unlike confidentiality or availability.
7. A security team defines who can access what data and under which conditions using formal
policies approved by leadership. This activity belongs to:
Confidential Study Use Only — Not Affiliated with or Endorsed by GIAC/SANS — Does Not Contain Actual Exam Content
, GFACT Practice Exam 2026/2027 • GIAC Foundational Cybersecurity Technologies • Unofficial Study Aid
A. Incident containment
B. Penetration testing
C. Vulnerability management
D. Security governance
Rationale: Governance establishes policies, roles, and oversight for security. Vulnerability
management and pen testing are operational, containment is incident response.
8. Which security model enforces the principle of least privilege by default-deny and granting only
necessary permissions?
A. Security through obscurity
B. Defense in depth
C. Least privilege / Need-to-know
D. Open design
Rationale: Least privilege limits access to the minimum necessary to perform duties, reducing blast
radius. Defense in depth layers controls; obscurity is not a reliable control.
9. Layering firewalls, endpoint protection, and user training to protect an asset is an example of:
A. Single point of failure
B. Separation of duties
C. Risk transference
D. Defense in depth
Rationale: Defense in depth uses multiple complementary controls so failure of one does not mean
total compromise. Separation of duties splits responsibilities to prevent fraud.
10. An auditor reviews logs that record who accessed a medical record, when, and what actions
were taken. Which AAA component is this?
A. Accounting/Auditing
B. Authentication
C. Authorization
D. Availability
Rationale: Accounting (auditing) tracks and logs user activities for accountability and forensics.
Authentication and authorization occur before access.
11. A company assigns the tasks of requesting and approving wire transfers to different employees.
This control is:
A. Least privilege
B. Separation of duties
C. Data masking
D. Job rotation
Confidential Study Use Only — Not Affiliated with or Endorsed by GIAC/SANS — Does Not Contain Actual Exam Content
, GFACT Practice Exam 2026/2027 • GIAC Foundational Cybersecurity Technologies • Unofficial Study Aid
Rationale: Separation of duties prevents a single person from completing a critical transaction
alone, reducing fraud. Job rotation detects hidden fraud over time.
12. What is the primary purpose of a security awareness training program?
A. To replace technical controls
B. To reduce risk from human factors like phishing and social engineering
C. To guarantee 100% security
D. To satisfy network throughput requirements
Rationale: Awareness training addresses the human attack surface, improving recognition of
phishing and handling of data. It complements, not replaces, technical controls and cannot
guarantee perfect security.
13. Which term describes the process of identifying, estimating, and prioritizing risks to
organizational operations?
A. Configuration management
B. Risk management
C. Patch management
D. Change management
Rationale: Risk management systematically assesses threats, vulnerabilities, and impacts to
prioritize mitigation. Patch/change/config management are related but narrower.
14. A risk assessment determines a threat is unlikely but impact would be catastrophic, so the
organization buys cyber insurance. This is:
A. Risk transference
B. Risk avoidance
C. Risk acceptance
D. Risk mitigation
Rationale: Transference shifts financial impact to a third party (insurance). Mitigation reduces
likelihood/impact, avoidance eliminates the activity, acceptance tolerates it.
15. The CIA triad is extended with AAA and non-repudiation to provide:
A. Only network speed metrics
B. A comprehensive model for information assurance and accountability
C. Physical security only
D. Compliance with wiring standards
Rationale: AAA and non-repudiation add identity, access control, auditability, and proof of actions to
confidentiality, integrity, and availability for complete assurance.
Confidential Study Use Only — Not Affiliated with or Endorsed by GIAC/SANS — Does Not Contain Actual Exam Content
GFACT CERTIFICATION EXAM 2026/2027 NEWEST VERSION
ACTUAL 160Q&A FREQUENTLY TESTED Q&A
GIAC Foundational Cybersecurity Technologies — Practice Exam | 160 Questions with Detailed Rationales
IMPORTANT DISCLAIMER: This document is an independent, original PRACTICE exam created to help candidates study the GFACT
domains as published in the GIAC GFACT Exam Objectives. It is NOT affiliated with, endorsed by, or sourced from GIAC/SANS, and does
NOT contain actual GIAC exam questions ("brain dumps"). GIAC exams are confidential and protected. Use this practice test solely to
assess your understanding of foundational cybersecurity principles.
The GIAC Foundational Cybersecurity Technologies (GFACT) certification validates foundational knowledge
essential for any cybersecurity role. This practice exam mirrors the style, breadth, and difficulty of the
GFACT domains, covering information security fundamentals, networking, operating systems, cryptography,
security controls, cloud, data protection, incident response, and governance/compliance to help you identify
strengths and focus your study for the 2026/2027 objectives.
Instructions: Select the best answer for each scenario. The correct answer is highlighted in bold cyan. Each question
includes a 2–3 sentence rationale explaining the correct choice and why distractors are incorrect. Aim to complete the 160
questions under timed, exam-like conditions and review rationales thoroughly.
Section 1: Brief Introduction
Section 2: The Complete Exam
Domains covered: Information Security Fundamentals • Networking Fundamentals • Operating Systems • Cybersecurity Concepts •
Cryptography • Security Controls • Cloud Computing • Data Security • Incident Response • Security Policies & Compliance | Time:
Simulate 4 hours | Passing guidance: Review rationales, not just scores.
1. A financial analyst sends a confidential earnings report via email without encryption, and it is
intercepted in transit. Which CIA triad principle was primarily violated?
A. Non-repudiation
B. Integrity
C. Availability
D. Confidentiality
Rationale: Confidentiality prevents unauthorized disclosure. The interception exposed sensitive data
without authorization, while integrity concerns alteration and availability concerns access; non-
repudiation is about proving origin.
2. A hospital's database log shows that a checksum mismatch was detected after a power failure,
indicating records were altered. Which CIA principle is directly affected?
A. Integrity
B. Availability
C. Authentication
D. Confidentiality
Rationale: Integrity ensures data remains accurate and unaltered. A checksum mismatch signals
unauthorized or accidental modification, whereas confidentiality is about disclosure and availability
is about uptime.
Confidential Study Use Only — Not Affiliated with or Endorsed by GIAC/SANS — Does Not Contain Actual Exam Content
, GFACT Practice Exam 2026/2027 • GIAC Foundational Cybersecurity Technologies • Unofficial Study Aid
3. A retail website experiences a DDoS attack that makes the checkout page unreachable for 4
hours. Which CIA principle is compromised?
A. Availability
B. Authorization
C. Integrity
D. Confidentiality
Rationale: Availability ensures authorized users can access systems when needed. The DDoS
disrupted service; confidentiality and integrity were not directly violated.
4. A user successfully logs in with username and password, then the system checks whether their
role permits access to the payroll folder. What is this second step called?
A. Attestation
B. Authentication
C. Authorization
D. Accounting
Rationale: Authentication verifies identity, while authorization enforces what an authenticated
identity is allowed to do. Accounting (auditing) tracks actions after access.
5. An organization requires employees to use badge + PIN to enter the data center. This is an
example of:
A. Federated identity
B. Single sign-on
C. Multi-factor authentication
D. Single-factor authentication
Rationale: MFA requires two or more factor categories (something you have = badge, something you
know = PIN). Single-factor uses one, SSO and federation concern access across systems.
6. After a contract is signed digitally, the signer cannot later deny having signed it because the
signature is cryptographically tied to them. Which principle does this demonstrate?
A. Non-repudiation
B. Availability
C. Least privilege
D. Confidentiality
Rationale: Non-repudiation provides proof of origin/integrity so an actor cannot deny an action.
Digital signatures provide this, unlike confidentiality or availability.
7. A security team defines who can access what data and under which conditions using formal
policies approved by leadership. This activity belongs to:
Confidential Study Use Only — Not Affiliated with or Endorsed by GIAC/SANS — Does Not Contain Actual Exam Content
, GFACT Practice Exam 2026/2027 • GIAC Foundational Cybersecurity Technologies • Unofficial Study Aid
A. Incident containment
B. Penetration testing
C. Vulnerability management
D. Security governance
Rationale: Governance establishes policies, roles, and oversight for security. Vulnerability
management and pen testing are operational, containment is incident response.
8. Which security model enforces the principle of least privilege by default-deny and granting only
necessary permissions?
A. Security through obscurity
B. Defense in depth
C. Least privilege / Need-to-know
D. Open design
Rationale: Least privilege limits access to the minimum necessary to perform duties, reducing blast
radius. Defense in depth layers controls; obscurity is not a reliable control.
9. Layering firewalls, endpoint protection, and user training to protect an asset is an example of:
A. Single point of failure
B. Separation of duties
C. Risk transference
D. Defense in depth
Rationale: Defense in depth uses multiple complementary controls so failure of one does not mean
total compromise. Separation of duties splits responsibilities to prevent fraud.
10. An auditor reviews logs that record who accessed a medical record, when, and what actions
were taken. Which AAA component is this?
A. Accounting/Auditing
B. Authentication
C. Authorization
D. Availability
Rationale: Accounting (auditing) tracks and logs user activities for accountability and forensics.
Authentication and authorization occur before access.
11. A company assigns the tasks of requesting and approving wire transfers to different employees.
This control is:
A. Least privilege
B. Separation of duties
C. Data masking
D. Job rotation
Confidential Study Use Only — Not Affiliated with or Endorsed by GIAC/SANS — Does Not Contain Actual Exam Content
, GFACT Practice Exam 2026/2027 • GIAC Foundational Cybersecurity Technologies • Unofficial Study Aid
Rationale: Separation of duties prevents a single person from completing a critical transaction
alone, reducing fraud. Job rotation detects hidden fraud over time.
12. What is the primary purpose of a security awareness training program?
A. To replace technical controls
B. To reduce risk from human factors like phishing and social engineering
C. To guarantee 100% security
D. To satisfy network throughput requirements
Rationale: Awareness training addresses the human attack surface, improving recognition of
phishing and handling of data. It complements, not replaces, technical controls and cannot
guarantee perfect security.
13. Which term describes the process of identifying, estimating, and prioritizing risks to
organizational operations?
A. Configuration management
B. Risk management
C. Patch management
D. Change management
Rationale: Risk management systematically assesses threats, vulnerabilities, and impacts to
prioritize mitigation. Patch/change/config management are related but narrower.
14. A risk assessment determines a threat is unlikely but impact would be catastrophic, so the
organization buys cyber insurance. This is:
A. Risk transference
B. Risk avoidance
C. Risk acceptance
D. Risk mitigation
Rationale: Transference shifts financial impact to a third party (insurance). Mitigation reduces
likelihood/impact, avoidance eliminates the activity, acceptance tolerates it.
15. The CIA triad is extended with AAA and non-repudiation to provide:
A. Only network speed metrics
B. A comprehensive model for information assurance and accountability
C. Physical security only
D. Compliance with wiring standards
Rationale: AAA and non-repudiation add identity, access control, auditability, and proof of actions to
confidentiality, integrity, and availability for complete assurance.
Confidential Study Use Only — Not Affiliated with or Endorsed by GIAC/SANS — Does Not Contain Actual Exam Content
