Intelligence Gathering & Threat Modeling GICSP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When analyzing the attack surface of an industrial control system, which of the following is most important to consider?

   • AThe physical location of the plant
   • BThe brand of the office coffee machine
   • CThe network interfaces and protocols used by the control devices
   • DThe number of employees in the control room
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A risk assessment at a hydroelectric dam identifies two threats: a ransomware attack on the corporate network and a physical intrusion into the control room. The corporate network is well-segmented from the OT network, and the control room has biometric access controls. Which threat should be prioritized for mitigation?

   • AThe ransomware attack, because it is more likely to occur
   • BThe physical intrusion, because it could directly compromise the OT systems
   • CNeither, because existing controls are sufficient
   • DBoth equally, because they have the same risk score
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is gathering intelligence on a competitor's ICS environment for a red team exercise. The analyst wants to identify the types of PLCs and HMIs used without sending any packets to the target. Which source of information would be most useful?

   • ASocial engineering calls to the target's help desk
   • BA direct connection to the target's FTP server to list files
   • CJob postings and technical forums where employees discuss the systems they use
   • DNmap scan results from the target's public IP range
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an attack surface analysis of a water treatment facility, the team identifies that the engineering workstation has a direct Ethernet connection to both the corporate network and the PLC network. Which of the following best describes the risk introduced by this configuration?

   • AIt only affects the availability of the PLC network, not security
   • BIt has no impact on the attack surface because the workstation is patched
   • CIt creates a bridge between the corporate and control networks, expanding the attack surface
   • DIt improves network segmentation and reduces the attack surface
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A vulnerability assessment at a steel mill found that the PLCs are accessible from the corporate network via a misconfigured router. The PLCs use a proprietary protocol that is not well-documented. The security team must decide whether to patch the router or implement a firewall rule. The plant cannot afford downtime during business hours. Which action should be taken first?

   • APatch the router immediately, even if it causes a brief outage
   • BImplement a firewall rule to block traffic from the corporate network to the PLC subnet
   • CDisconnect the PLCs from the network until the router is patched
   • DDo nothing because the proprietary protocol is not exploitable
   Reveal Solution Discussion Select an answer first