What is the primary function of a host-based firewall on an endpoint?

To monitor user activity and log keystrokes

To encrypt data stored on the hard drive

To scan files for malware signatures

To filter incoming and outgoing network traffic based on a set of rules

Why is it important to securely decommission an endpoint?

To reduce the weight of the device for shipping

To increase the resale value of the hardware

To ensure the device can be reused by another employee without reconfiguration

To prevent sensitive data from being recovered after the device is disposed of or repurposed

A power utility has a control room with several operator workstations that are accessible to cleaning staff after hours. The workstations are not physically locked. Which physical security measure is the most effective to prevent unauthorized access?

Implement a combination of door access control, screen lock with idle timeout, and cable locks.

Use cable locks to secure each workstation to the desk.

Install a badge reader on the control room door and require all personnel to authenticate before entering.

Require a password to unlock the screen on each workstation after a short idle timeout.

A power utility has a patch management process that requires testing on a replica system before deployment. A critical security patch is released for the HMI software, but the replica system is currently unavailable. What should the patch management team do?

Skip the patch and rely on compensating controls.

Deploy the patch to a small subset of HMIs and monitor for issues.

Wait until the replica system is available, then test and deploy.

Deploy the patch immediately to all HMIs to reduce risk.

What is the principle of least privilege in endpoint access control?

All users are granted administrative privileges to ensure they can perform any task

Users and processes are granted only the minimum permissions necessary to perform their job functions

Permissions are granted once and never changed

Users are granted permissions based on their seniority in the organization

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 1

Hardening & Protecting Endpoints GICSP Practice Questions (Page 1)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 1–5

1foundation · easy
What is the primary function of a host-based firewall on an endpoint?
Select an answer first
2foundation · easy
Why is it important to securely decommission an endpoint?
Select an answer first
3application · medium
A power utility has a control room with several operator workstations that are accessible to cleaning staff after hours. The workstations are not physically locked. Which physical security measure is the most effective to prevent unauthorized access?
Select an answer first
4application · medium
A power utility has a patch management process that requires testing on a replica system before deployment. A critical security patch is released for the HMI software, but the replica system is currently unavailable. What should the patch management team do?
Select an answer first
5foundation · easy
What is the principle of least privilege in endpoint access control?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.