Hardening & Protecting Endpoints GICSP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A water treatment facility has a shared engineering workstation used by shift operators and a remote vendor support engineer. The vendor engineer needs to install and configure software, but the operators only need to run the SCADA client. The security team wants to enforce least privilege and improve accountability. What should they do?

   • ACreate separate user accounts for each operator and the vendor, assign the vendor a standard user account, and use a privileged access management solution to grant temporary administrative rights when needed.
   • BDisable all local accounts and require the vendor to use a remote desktop gateway with no additional authentication.
   • CAdd all users to the local Administrators group so they can install software without delays.
   • DGive the vendor engineer the local administrator password and have operators share a common user account for simplicity.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A remote pumping station has an RTU in an unlocked cabinet. The station is visited by a technician once a month. What is the most effective physical security measure to prevent unauthorized access to the RTU?

   • AInstall a tamper-evident seal on the cabinet door.
   • BInstall a security camera pointing at the cabinet.
   • CRequire two-factor authentication for the RTU's local console.
   • DReplace the cabinet lock with a high-security lock and control key distribution.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary goal of endpoint hardening in an industrial control system environment?

   • ATo replace all legacy endpoints with modern hardware to improve performance
   • BTo isolate the endpoint from the network so it cannot communicate with any other system
   • CTo reduce the attack surface by applying security configurations and controls that minimize vulnerabilities
   • DTo ensure the endpoint is running the latest operating system version at all times
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A food processing plant wants to deploy host-based intrusion prevention (HIPS) on its packaging line HMIs. The HMIs run a proprietary application that is sensitive to latency. What is the most important consideration before deploying HIPS?

   • ATest the HIPS in a staging environment to measure performance impact on the application.
   • BConfigure the HIPS to block all unknown traffic.
   • CEnsure the HIPS signatures are updated daily.
   • DDeploy the HIPS in monitor mode initially to avoid any impact.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A hospital's building management system (BMS) uses a shared service account to run the HVAC control software on multiple servers. The security team wants to improve accountability and reduce risk. What is the most effective change?

   • AUse a hardware security module (HSM) to store the shared account password.
   • BReplace the shared account with individual user accounts for each administrator, and use a privileged access management (PAM) solution to manage and rotate credentials.
   • CKeep the shared account but change the password every 90 days.
   • DDisable the shared account and require administrators to use their personal accounts with local admin rights.
   Reveal Solution Discussion Select an answer first