What is the purpose of physical security controls for industrial endpoints?

To ensure the endpoint is connected to the network at all times

To provide power backup in case of electrical outages

To prevent unauthorized physical access that could lead to tampering, theft, or damage

To monitor the endpoint's performance and resource usage

A wastewater treatment plant has a SCADA server that is not patched due to vendor restrictions. The security team wants to detect if an attacker is attempting to brute-force the administrator account. What should they monitor?

Windows Security event logs for repeated failed logon attempts (Event ID 4625).

The server's file system for new files.

Network traffic to the server on port 80.

A chemical plant has a patch management policy that requires all patches to be tested in a staging environment that mirrors production. A critical patch is released for the DCS, but the staging environment is not identical because it lacks the latest process control software. The plant manager wants to deploy the patch immediately to reduce risk. What is the best course of action?

Deploy the patch to a single production DCS and monitor for issues.

Update the staging environment to match production, then test and deploy the patch.

Deploy the patch to production immediately because the risk of not patching is higher.

Skip the patch and implement additional monitoring and compensating controls.

A mining company has a fleet of ruggedized tablets used by field operators to view maintenance procedures. The tablets run a custom Android app that is not updated frequently. The security team wants to protect the tablets from malware. Which control is most effective?

Use a third-party antivirus app that scans for malware on a weekly basis.

Install a mobile device management (MDM) solution that enforces a security policy, including application whitelisting and remote wipe.

Enable the Android 'Unknown sources' setting to allow installation of apps from any source.

Disable the tablet's Wi-Fi and Bluetooth to prevent network-based attacks.

A chemical plant has a legacy Windows 7 engineering workstation that cannot be upgraded. The security team is evaluating endpoint protection tools. Which tool characteristic is most important to avoid disrupting production?

The tool supports a read-only mode that does not block or quarantine files without explicit approval.

The tool includes a cloud-based management console for remote monitoring.

The tool has a small memory footprint and uses less than 100 MB of RAM.

The tool automatically updates its virus definitions every hour.

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 1

Hardening & Protecting Endpoints GICSP Practice Questions (Page 6)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 26–30

26foundation · easy
What is the purpose of physical security controls for industrial endpoints?
Select an answer first
27application · medium
A wastewater treatment plant has a SCADA server that is not patched due to vendor restrictions. The security team wants to detect if an attacker is attempting to brute-force the administrator account. What should they monitor?
Select an answer first
28expert · medium
A chemical plant has a patch management policy that requires all patches to be tested in a staging environment that mirrors production. A critical patch is released for the DCS, but the staging environment is not identical because it lacks the latest process control software. The plant manager wants to deploy the patch immediately to reduce risk. What is the best course of action?
Select an answer first
29application · medium
A mining company has a fleet of ruggedized tablets used by field operators to view maintenance procedures. The tablets run a custom Android app that is not updated frequently. The security team wants to protect the tablets from malware. Which control is most effective?
Select an answer first
30application · medium
A chemical plant has a legacy Windows 7 engineering workstation that cannot be upgraded. The security team is evaluating endpoint protection tools. Which tool characteristic is most important to avoid disrupting production?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.