Which of the following is a common vulnerability found in industrial control systems due to the use of legacy protocols?

Implementation of network segmentation between IT and OT

Excessive use of HTTPS for HMI communication

Use of modern operating systems on HMIs

Lack of encryption and authentication in Modbus TCP

A security consultant is tasked with identifying internet-facing OT devices for a client. The client wants to avoid any interaction with the devices. Which method should the consultant use?

Send a crafted Modbus read request to a known IP address

Connect to the devices using a web browser to verify their web interfaces

Search Shodan for the client's IP ranges and filter for known OT protocols

Use Nmap to scan the client's IP ranges for port 502

A vulnerability assessment of a chemical plant's control system reveals that the HMI software runs with administrative privileges and accepts network connections from any source. Which of the following is the most direct vulnerability that an attacker could exploit?

Weak password policy for operators

Unrestricted network exposure combined with excessive privileges

Missing antivirus on the engineering workstation

Lack of encryption on the HMI's database

GIAC Global Industrial Cyber Security Professional

Domain 2Objective 1

Intelligence Gathering & Threat Modeling GICSP Practice Questions (Page 3)

Part of the Threats, Vulnerabilities, and Compromises domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 11–15

11foundation · easy
Which of the following is a common vulnerability found in industrial control systems due to the use of legacy protocols?
Select an answer first
12application · medium
A security consultant is tasked with identifying internet-facing OT devices for a client. The client wants to avoid any interaction with the devices. Which method should the consultant use?
Select an answer first
13application · medium
A manufacturing plant uses a legacy Windows 2000 HMI that cannot be patched. A threat model must prioritize mitigations. Using the STRIDE framework, which threat category is most directly associated with an attacker modifying the HMI's displayed process values to hide a dangerous condition?
Select an answer first
14application · medium
A threat intelligence analyst is profiling a threat actor that has targeted multiple manufacturing companies. The actor's tactics include using spear-phishing emails with malicious Excel attachments, then using PowerShell to download additional tools. The actor's motivation appears to be financial gain through ransomware. Which threat actor profile best matches this behavior?
Select an answer first
15application · medium
A vulnerability assessment of a chemical plant's control system reveals that the HMI software runs with administrative privileges and accepts network connections from any source. Which of the following is the most direct vulnerability that an attacker could exploit?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.

Intelligence Gathering & Threat Modeling GICSP Practice Questions (Page 3)

Questions 11–15

Which of the following is a common vulnerability found in industrial control systems due to the use of legacy protocols?

A security consultant is tasked with identifying internet-facing OT devices for a client. The client wants to avoid any interaction with the devices. Which method should the consultant use?

A manufacturing plant uses a legacy Windows 2000 HMI that cannot be patched. A threat model must prioritize mitigations. Using the STRIDE framework, which threat category is most directly associated with an attacker modifying the HMI's displayed process values to hide a dangerous condition?

A vulnerability assessment of a chemical plant's control system reveals that the HMI software runs with administrative privileges and accepts network connections from any source. Which of the following is the most direct vulnerability that an attacker could exploit?

Keep studying — Threats, Vulnerabilities, and Compromises