A water treatment plant has a critical control system that communicates with remote pumps over a serial-to-Ethernet gateway. The gateway has a web interface for configuration that is accessible from the corporate network. The security team wants to reduce the attack surface while maintaining the ability to configure the gateway remotely. What is the best approach?

Move the gateway to the corporate network and enable remote desktop for configuration.

Disable the web interface and require physical access to the gateway for configuration.

Restrict access to the web interface to specific management IP addresses and enforce strong authentication.

Leave the web interface accessible but monitor all access attempts.

Which of the following is a characteristic of a strong password policy?

Setting passwords to never expire

Requiring a minimum length and complexity

Storing passwords in plain text

Allowing users to reuse previous passwords

A nuclear power plant has a safety system that runs on a real-time operating system (RTOS) with strict availability requirements. The vendor has released a patch for a critical vulnerability, but the patch has not been certified for use in safety systems. The plant's security team must decide how to proceed. Which action is most appropriate?

Defer the patch until the vendor certifies it, and implement compensating controls in the meantime

Disconnect the safety system from the network until the patch is applied

Apply the patch only to the non-safety backup system

Apply the patch immediately because the vulnerability is critical

Why is it important to protect system logs from unauthorized modification?

To ensure the integrity of evidence for security investigations

To comply with user password policies

Before deploying a security patch to a production critical system, what step is essential in a systematic patch management process?

Notify users to avoid using the system

Immediately deploy the patch to all systems

Disable the affected service permanently

Test the patch in a non-production environment

GIAC Critical Infrastructure Protection (GCIP)

Domain 2Objective 3

System Security Management GCIP Practice Questions (Page 1)

Part of the Cyber System Identification and Protection domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 1–5

1expert · hard
A water treatment plant has a critical control system that communicates with remote pumps over a serial-to-Ethernet gateway. The gateway has a web interface for configuration that is accessible from the corporate network. The security team wants to reduce the attack surface while maintaining the ability to configure the gateway remotely. What is the best approach?
Select an answer first
2foundation · easy
Which of the following is a characteristic of a strong password policy?
Select an answer first
3expert · hard
A nuclear power plant has a safety system that runs on a real-time operating system (RTOS) with strict availability requirements. The vendor has released a patch for a critical vulnerability, but the patch has not been certified for use in safety systems. The plant's security team must decide how to proceed. Which action is most appropriate?
Select an answer first
4foundation · easy
Why is it important to protect system logs from unauthorized modification?
Select an answer first
5foundation · easy
Before deploying a security patch to a production critical system, what step is essential in a systematic patch management process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIP” is a trademark of its owner, used for identification only.