Intelligence Gathering & Threat Modeling GICSP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A refinery has limited budget for OT security improvements. A risk assessment identified two high-risk findings: (1) unauthenticated access to the engineering workstation's remote desktop service, and (2) lack of monitoring on the process control network. The plant manager wants to address the finding with the highest residual risk after mitigation. Which approach should the security team recommend?

   • ADisable the remote desktop service first, because it is a direct entry point
   • BConduct a penetration test to confirm which finding is more exploitable
   • CDo both simultaneously, splitting the budget evenly
   • DImplement network monitoring on the process control network first, because undetected intrusions can persist for months
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A vulnerability scan of a water utility's OT network identifies that the HMI software has a known remote code execution vulnerability. The vendor has released a patch, but the utility cannot apply it immediately because the HMI is critical and cannot be rebooted. Which compensating control should be implemented first?

   • ADisable the HMI's network interface
   • BInstall a host-based firewall on the HMI to block all inbound traffic
   • CIncrease logging on the HMI
   • DRestrict network access to the HMI to only authorized engineering workstations
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security assessor is mapping the attack surface of a chemical plant. The plant has a corporate network, a DMZ with a data historian, and an OT network with PLCs and HMIs. Which of the following is the most significant attack surface expansion that should be documented?

   • AThe HMIs are running a modern operating system with the latest patches
   • BThe corporate network uses a firewall that blocks all inbound traffic from the internet
   • CThe PLCs are programmed using a vendor-specific protocol over serial connections
   • DThe data historian has a direct TCP connection to both the corporate network and the OT network
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is analyzing a cyber incident at a wastewater treatment plant. The attackers used publicly available exploit code for a known vulnerability in the plant's SCADA software, and the attack was opportunistic rather than targeted. Which threat actor profile is most consistent with this incident?

   • AA cybercriminal group using commodity tools
   • BA disgruntled insider with physical access
   • CA hacktivist group with a specific political agenda
   • DA nation-state APT with custom zero-day exploits
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is profiling a threat actor that has been observed using stolen credentials to access a utility's VPN, then moving laterally to the OT network and modifying setpoints on a PLC. The actor's actions were precise and caused minimal disruption. Which threat actor profile is most likely?

   • AA cybercriminal group demanding ransom
   • BAn insider with authorized access
   • CA nation-state actor conducting a covert operation
   • DA hacktivist group seeking to cause public disruption
   Reveal Solution Discussion Select an answer first