What is a secure configuration baseline?

A backup of the endpoint's configuration files stored offsite

A list of all software installed on an endpoint for inventory purposes

A documented set of security settings and configurations applied to an endpoint to ensure a consistent, hardened state

A network diagram showing how endpoints are connected

A chemical plant has a patch management process that requires a maintenance window for deployment. A critical patch is released, but the next maintenance window is in two weeks. The plant manager wants to deploy the patch sooner. What is the best way to handle this?

Apply the patch only to non-critical systems and wait for the maintenance window for critical ones.

Wait for the next scheduled maintenance window and deploy then.

Deploy the patch immediately without a maintenance window to reduce risk.

Schedule an emergency maintenance window and follow the change management process.

An OT security team wants to detect unauthorized changes to critical endpoint configuration files. What is the most effective monitoring technique?

Schedule daily manual checks of file hashes.

Use a host-based firewall to log all file access attempts.

Enable Windows Event Logging for all security events.

Deploy a file integrity monitoring (FIM) tool that alerts on changes to critical files.

Which of the following is an example of a physical security control for an endpoint?

A host-based firewall configuration

A locked server room with access card entry

A strong password policy for user accounts

A chemical plant has a historian server that is critical for compliance reporting. The server is not patched due to vendor restrictions. The security team wants to detect a potential intrusion without impacting performance. Which monitoring strategy is most effective?

Install a host-based intrusion prevention system (HIPS) with active blocking.

Deploy a network-based intrusion detection system (IDS) that monitors traffic to and from the historian server.

Take regular backups and restore the server if an intrusion is suspected.

Enable verbose logging on the server and send all logs to a SIEM in real time.

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 1

Hardening & Protecting Endpoints GICSP Practice Questions (Page 2)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 6–10

6foundation · easy
What is a secure configuration baseline?
Select an answer first
7expert · medium
A chemical plant has a patch management process that requires a maintenance window for deployment. A critical patch is released, but the next maintenance window is in two weeks. The plant manager wants to deploy the patch sooner. What is the best way to handle this?
Select an answer first
8application · medium
An OT security team wants to detect unauthorized changes to critical endpoint configuration files. What is the most effective monitoring technique?
Select an answer first
9foundation · easy
Which of the following is an example of a physical security control for an endpoint?
Select an answer first
10expert · hard
A chemical plant has a historian server that is critical for compliance reporting. The server is not patched due to vendor restrictions. The security team wants to detect a potential intrusion without impacting performance. Which monitoring strategy is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.