Intelligence Gathering & Threat Modeling GICSP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security engineer is analyzing the attack surface of a building automation system (BAS) that controls HVAC and lighting. The BAS has a web interface accessible from the corporate network, and the controller uses BACnet/IP on the OT network. Which of the following is the most critical attack surface to address?

   • AThe web interface is accessible from the corporate network without multi-factor authentication
   • BThe HVAC system uses a proprietary protocol for maintenance
   • CThe BACnet/IP protocol is used on the OT network
   • DThe lighting system is controlled by a separate controller
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An ICS risk assessment identifies two threats: a worm that could disrupt the entire plant's operations, and a phishing campaign that could compromise a single operator's credentials. The worm has a low likelihood but high impact, while the phishing campaign has a high likelihood but low impact. Using a standard risk matrix, which threat should be prioritized for mitigation?

   • ABoth should be prioritized equally because they are both risks
   • BNeither should be prioritized because they are both common
   • CThe phishing campaign, because high likelihood is more important than impact
   • DThe worm, because high impact is more important than likelihood
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security architect is applying the PASTA threat modeling methodology to a new cloud-based SCADA system. The architect has identified that the system uses a public API for data exchange. Which of the following is the most appropriate next step in the PASTA process?

   • AImmediately implement a web application firewall
   • BConduct a penetration test on the API
   • CDecompose the application to identify trust boundaries and data flows
   • DDevelop a risk mitigation plan without further analysis
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A penetration tester is conducting a red team exercise against an electric utility. The tester wants to identify the make and model of the substation's protective relays without being detected by the SOC. Which intelligence gathering method is most likely to avoid detection?

   • ASearching public procurement records and vendor documentation
   • BUsing a brute-force attack on the relay's web interface
   • CPerforming a TCP connect scan on the relay's IP address
   • DSending a crafted DNP3 read request to the relay
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An ICS security team is using the STRIDE threat modeling framework to evaluate a new remote access solution for their control network. They have identified that an attacker could spoof a legitimate engineer's credentials to gain access. Which STRIDE category does this threat fall under, and what is the most appropriate mitigation to prioritize?

   • ATampering; implement integrity checks on data
   • BDenial of service; implement rate limiting
   • CInformation disclosure; encrypt all remote sessions
   • DSpoofing; implement multi-factor authentication
   Reveal Solution Discussion Select an answer first