A refinery has a Windows Server 2016 domain controller that is also used as a file server for the control system network. The security team wants to patch the server but is concerned about downtime. What is the best practice?

Apply the patch immediately during production hours to minimize the window of vulnerability.

Skip the patch because the server is not directly exposed to the internet.

Install the patch on the domain controller only if the vendor provides a hotfix.

Test the patch in a lab environment that mirrors the production setup, then schedule the patch during a planned maintenance window.

An OT security analyst is investigating a suspicious event on a PLC programming workstation. The workstation has a host-based firewall, antivirus, and a logging agent. The analyst finds that the antivirus has been disabled and the logging agent is not reporting. What is the most likely explanation?

The host-based firewall blocked the logging agent's traffic.

The workstation was not configured to start the logging agent automatically.

The workstation has been compromised and the attacker disabled the security tools.

The antivirus software crashed due to a software bug.

A pharmaceutical plant uses Windows 10 engineering workstations for batch control. The OT security team wants to harden these endpoints without breaking legacy serial drivers. They plan to enforce a security baseline, but the legacy software requires local administrator rights for one service account. Which approach best balances security and operational continuity?

Replace the legacy software with a modern version that supports least-privilege operation before applying the baseline.

Apply the security baseline but exempt the specific service account from least-privilege restrictions and document the exception in the change management process.

Apply the full security baseline and remove the service account from the local Administrators group, then test the legacy software in a lab before deployment.

Skip the baseline on all engineering workstations to avoid any risk of breaking the legacy drivers.

What is the primary purpose of a patch management process in an industrial environment?

To systematically apply vendor-supplied updates that fix known vulnerabilities and software defects

To monitor network traffic for signs of malicious activity

To replace outdated hardware with newer models that have better security features

To configure endpoints with a secure baseline after initial installation

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 1

Hardening & Protecting Endpoints GICSP Practice Questions (Page 7)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 31–35

31foundation · easy
Which type of log is most likely to contain records of user authentication attempts on an endpoint?
Select an answer first
32application · medium
A refinery has a Windows Server 2016 domain controller that is also used as a file server for the control system network. The security team wants to patch the server but is concerned about downtime. What is the best practice?
Select an answer first
33expert · medium
An OT security analyst is investigating a suspicious event on a PLC programming workstation. The workstation has a host-based firewall, antivirus, and a logging agent. The analyst finds that the antivirus has been disabled and the logging agent is not reporting. What is the most likely explanation?
Select an answer first
34application · medium
A pharmaceutical plant uses Windows 10 engineering workstations for batch control. The OT security team wants to harden these endpoints without breaking legacy serial drivers. They plan to enforce a security baseline, but the legacy software requires local administrator rights for one service account. Which approach best balances security and operational continuity?
Select an answer first
35foundation · easy
What is the primary purpose of a patch management process in an industrial environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.

Hardening & Protecting Endpoints GICSP Practice Questions (Page 7)

Questions 31–35

Which type of log is most likely to contain records of user authentication attempts on an endpoint?

A refinery has a Windows Server 2016 domain controller that is also used as a file server for the control system network. The security team wants to patch the server but is concerned about downtime. What is the best practice?

An OT security analyst is investigating a suspicious event on a PLC programming workstation. The workstation has a host-based firewall, antivirus, and a logging agent. The analyst finds that the antivirus has been disabled and the logging agent is not reporting. What is the most likely explanation?

What is the primary purpose of a patch management process in an industrial environment?

Keep studying — Security Management and Response