A power generation plant has a turbine control system running on a legacy Windows XP embedded platform. The vendor will not support any security software that requires a kernel driver. The security team must harden the endpoint without installing kernel-level tools. Which combination of controls is most effective?

Upgrade the operating system to a modern version, even though the control software is not validated for it.

Disconnect the system from the network and rely on physical security only.

Network segmentation with a firewall, application whitelisting using a user-mode tool, and strict access control with individual accounts.

Install the latest antivirus software that uses a kernel driver, even though the vendor does not support it.

Which authentication mechanism is commonly used to provide an additional layer of security for endpoint access?

Multi-factor authentication (MFA)

Single sign-on (SSO) without additional verification

Why is it important to apply a secure configuration baseline to an industrial endpoint?

It eliminates the need for monitoring and logging on the endpoint

It ensures the endpoint is configured securely and consistently, reducing the risk of misconfiguration that could be exploited

It guarantees the endpoint will never be compromised by any attacker

It allows the endpoint to run any software without restrictions

Which endpoint protection tool is designed to detect and block malicious activity by analyzing behavior rather than relying solely on known signatures?

Host-based intrusion prevention system (HIPS)

Which step is typically part of a patch management process?

Ignoring patches for legacy systems because they are not supported

Immediately deploying all patches to production without prior testing

Deleting all logs after patching to save storage space

Testing patches in a non-production environment before deployment

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 1

Hardening & Protecting Endpoints GICSP Practice Questions (Page 4)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 16–20

16expert · hard
A power generation plant has a turbine control system running on a legacy Windows XP embedded platform. The vendor will not support any security software that requires a kernel driver. The security team must harden the endpoint without installing kernel-level tools. Which combination of controls is most effective?
Select an answer first
17foundation · easy
Which authentication mechanism is commonly used to provide an additional layer of security for endpoint access?
Select an answer first
18foundation · easy
Why is it important to apply a secure configuration baseline to an industrial endpoint?
Select an answer first
19foundation · easy
Which endpoint protection tool is designed to detect and block malicious activity by analyzing behavior rather than relying solely on known signatures?
Select an answer first
20foundation · easy
Which step is typically part of a patch management process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.