A vulnerability assessment of a hospital's building management system (BMS) reveals that several workstations have outdated antivirus definitions. The workstations are used to monitor HVAC controls and are not connected to the internet. The assessment also found that staff frequently use USB drives to transfer maintenance logs. What is the most likely reason the antivirus definitions are outdated?

The hospital's IT department does not prioritize the BMS workstations

The antivirus software is not compatible with the BMS operating system

The USB drives are infected with malware that disables antivirus updates

The workstations are isolated from the internet, so automatic updates cannot reach them

A pipeline company allows field technicians to use their own laptops for remote diagnostics. The laptops are used across multiple sites and connect to the corporate network via VPN. The company is considering a policy to require all laptops to be company-owned and managed. What is the most significant trade-off to consider?

The need for technicians to have personal use of the laptops versus the security restrictions

The risk of losing company laptops versus the risk of losing personal laptops

The cost of purchasing and maintaining company laptops versus the security benefit of full control over the devices

The compatibility of the laptops with existing diagnostic software versus the need for new software

A security analyst notices that a configuration monitoring alert fired for an engineering workstation in a power plant. The alert indicates that a new file was added to the startup folder. The workstation was recently used by a vendor technician who connected a USB drive to install a diagnostic tool. What should the analyst do first?

Disconnect the workstation from the network immediately to contain a potential malware infection

Delete the new file from the startup folder and restore the workstation to its baseline state

Compare the new file against the approved change baseline and investigate if it is not documented

Quarantine the USB drive and scan it for malware before allowing further use

A vulnerability assessment of a natural gas pipeline's SCADA network identified a missing security patch on a historian server. The patch requires a reboot, which would interrupt data collection for several hours. The change management board has a policy that all patches must be tested in a lab before production deployment. What is the best course of action?

Apply the patch only to other servers and leave the historian unprotected to avoid downtime

Deploy the patch immediately to the production server to eliminate the vulnerability as soon as possible

Request an exception to skip testing and deploy directly because the vulnerability is critical

Test the patch in the lab, then submit a change request with a planned maintenance window for production deployment

A food processing plant uses USB drives to update the recipe files on its packaging line controllers. The plant has experienced a malware infection traced to a USB drive. The IT manager wants to maintain the ability to update recipes but reduce the risk. What is the best control to implement?

Purchase new USB drives and label them for control system use only.

Encrypt all USB drives and require a password to access them.

Disable USB ports on the packaging line controllers and require all recipe updates to be done via the network.

Implement a 'USB drive quarantine station' that scans and sanitizes drives before they are used on the control network.

GIAC Critical Infrastructure Protection (GCIP)

Domain 4Objective 1

Configuration Change Management and Vulnerability Assessments GCIP Practice Questions (Page 8)

Part of the Change, Vulnerability, and Incident Management domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 36–40

36application · medium
A vulnerability assessment of a hospital's building management system (BMS) reveals that several workstations have outdated antivirus definitions. The workstations are used to monitor HVAC controls and are not connected to the internet. The assessment also found that staff frequently use USB drives to transfer maintenance logs. What is the most likely reason the antivirus definitions are outdated?
Select an answer first
37expert · hard
A pipeline company allows field technicians to use their own laptops for remote diagnostics. The laptops are used across multiple sites and connect to the corporate network via VPN. The company is considering a policy to require all laptops to be company-owned and managed. What is the most significant trade-off to consider?
Select an answer first
38application · medium
A security analyst notices that a configuration monitoring alert fired for an engineering workstation in a power plant. The alert indicates that a new file was added to the startup folder. The workstation was recently used by a vendor technician who connected a USB drive to install a diagnostic tool. What should the analyst do first?
Select an answer first
39application · medium
A vulnerability assessment of a natural gas pipeline's SCADA network identified a missing security patch on a historian server. The patch requires a reboot, which would interrupt data collection for several hours. The change management board has a policy that all patches must be tested in a lab before production deployment. What is the best course of action?
Select an answer first
40application · medium
A food processing plant uses USB drives to update the recipe files on its packaging line controllers. The plant has experienced a malware infection traced to a USB drive. The IT manager wants to maintain the ability to update recipes but reduce the risk. What is the best control to implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.

Configuration Change Management and Vulnerability Assessments GCIP Practice Questions (Page 8)

Questions 36–40

A food processing plant uses USB drives to update the recipe files on its packaging line controllers. The plant has experienced a malware infection traced to a USB drive. The IT manager wants to maintain the ability to update recipes but reduce the risk. What is the best control to implement?

Keep studying — Change, Vulnerability, and Incident Management