A water utility has a mix of legacy and modern endpoints. The security team wants to implement a hardening standard, but the legacy endpoints cannot support the same security tools as the modern ones. What is the best approach?

Replace all legacy endpoints immediately to ensure uniform hardening.

Apply the same hardening standard to all endpoints, but disable features that are not supported.

Focus hardening efforts only on modern endpoints and accept the risk on legacy ones.

Create separate hardening baselines for legacy and modern endpoints based on their capabilities.

A pharmaceutical company has a validated manufacturing execution system (MES) that runs on a Windows Server 2016. The system is under a change-control process that requires any patch to be validated before deployment. A critical security patch for the OS was released, but the MES vendor has not yet validated it. What is the best course of action?

Wait for the vendor to validate the patch, and in the meantime implement compensating controls such as network segmentation and enhanced monitoring.

Apply the patch only to the test environment and leave the production system unpatched.

Apply the patch immediately to reduce security risk, and document the deviation from the change-control process.

Uninstall the MES software and reinstall it after the patch is applied.

A manufacturing company is decommissioning a batch of old operator workstations that contain sensitive process data. The workstations are still under warranty and will be returned to the vendor. What is the most important step before returning them?

Perform a full factory reset and reinstall the operating system.

Use a certified data sanitization tool to overwrite the hard drives multiple times, then verify the erasure.

Remove the hard drives and physically destroy them.

Delete all user files and empty the recycle bin.

A refinery is decommissioning an old DCS server. The server contains configuration files with passwords and process setpoints. What is the most important step before disposing of the server?

Keep the server in storage in case it is needed later.

Remove the hard drive and physically destroy it.

Delete the configuration files and empty the recycle bin.

Perform a quick format of the hard drive.

A pipeline facility has a control room with multiple operator workstations. The facility is in a remote area with limited staff. The security manager wants to ensure that only authorized personnel can access the control room. The facility has a badge reader, but it is often propped open for convenience. What is the most effective combination of physical and logical controls?

Install a mantrap with interlocking doors and require badge access for both doors.

Place a security camera at the entrance and rely on monitoring.

Require operators to sign in and out manually.

Use a keypad lock with a shared code for all operators.

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 1

Hardening & Protecting Endpoints GICSP Practice Questions (Page 9)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 41–45

41expert · medium
A water utility has a mix of legacy and modern endpoints. The security team wants to implement a hardening standard, but the legacy endpoints cannot support the same security tools as the modern ones. What is the best approach?
Select an answer first
42expert · hard
A pharmaceutical company has a validated manufacturing execution system (MES) that runs on a Windows Server 2016. The system is under a change-control process that requires any patch to be validated before deployment. A critical security patch for the OS was released, but the MES vendor has not yet validated it. What is the best course of action?
Select an answer first
43application · medium
A manufacturing company is decommissioning a batch of old operator workstations that contain sensitive process data. The workstations are still under warranty and will be returned to the vendor. What is the most important step before returning them?
Select an answer first
44application · medium
A refinery is decommissioning an old DCS server. The server contains configuration files with passwords and process setpoints. What is the most important step before disposing of the server?
Select an answer first
45expert · medium
A pipeline facility has a control room with multiple operator workstations. The facility is in a remote area with limited staff. The security manager wants to ensure that only authorized personnel can access the control room. The facility has a badge reader, but it is often propped open for convenience. What is the most effective combination of physical and logical controls?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.

Hardening & Protecting Endpoints GICSP Practice Questions (Page 9)

Questions 41–45

A water utility has a mix of legacy and modern endpoints. The security team wants to implement a hardening standard, but the legacy endpoints cannot support the same security tools as the modern ones. What is the best approach?

A manufacturing company is decommissioning a batch of old operator workstations that contain sensitive process data. The workstations are still under warranty and will be returned to the vendor. What is the most important step before returning them?

A refinery is decommissioning an old DCS server. The server contains configuration files with passwords and process setpoints. What is the most important step before disposing of the server?

Keep studying — Security Management and Response