Intelligence Gathering & Threat Modeling GICSP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A risk assessment at a nuclear research facility identifies two risks: a cyber attack on the control system that could cause a radioactive release, and a cyber attack on the corporate network that could result in data theft. The control system is air-gapped, while the corporate network is connected to the internet. Which risk should be prioritized?

   • ABoth equally, because they are both cyber attacks
   • BThe corporate network attack, because it is more likely to occur
   • CNeither, because the control system is air-gapped and the corporate network has antivirus
   • DThe control system attack, because the impact is catastrophic
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A threat intelligence team is analyzing a series of attacks against multiple energy companies. The attacks involve the use of a custom malware that targets specific PLC models and requires deep knowledge of the industrial process. The malware is designed to cause physical damage to equipment. Which threat actor profile is most likely responsible, and what is the primary intelligence gathering method they likely used?

   • ACybercriminal group; active scanning of the target's network
   • BInsider threat; direct access to the PLCs
   • CHacktivist; social engineering of employees
   • DNation-state actor; passive intelligence gathering from public sources and insider knowledge
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A security analyst is performing passive intelligence gathering on an industrial control system (ICS) environment. Which activity best exemplifies passive intelligence gathering?

   • AAttempting to log in to an HMI with default credentials
   • BScanning the ICS network with Nmap to enumerate open ports
   • CReviewing publicly available vendor documentation and job postings for ICS-related details
   • DSending crafted Modbus packets to a PLC to observe its response
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security consultant is tasked with performing a threat assessment for a pharmaceutical manufacturer. The consultant needs to identify the attack surface of the OT network without disrupting production. The OT network is isolated from the internet but has a remote access server for vendors. Which combination of intelligence gathering methods is most appropriate?

   • APassive network monitoring on the OT network and reviewing vendor remote access logs
   • BSocial engineering of plant operators to gain credentials
   • CActive scanning of all OT devices with Nmap
   • DUsing Shodan to find internet-exposed devices
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is considered part of the attack surface of an industrial control system?

   • AThe Modbus TCP port exposed on a PLC that is accessible from the control network
   • BThe corporate firewall that separates the IT network from the internet
   • CThe backup generator used for emergency power
   • DThe physical security guards at the facility entrance
   Reveal Solution Discussion Select an answer first