During a vulnerability assessment of a food processing plant, a tester discovers that the engineering workstation can reach the PLC subnet directly without traversing any firewall. The workstation also has a default account with a well-known password. Which vulnerability is most critical to remediate first?

The default account on the workstation

Lack of network segmentation between the engineering workstation and PLCs

The workstation's operating system is outdated

The PLCs are using a proprietary protocol

A threat modeling team is using the PASTA framework to assess a new remote monitoring system for a pipeline. The system uses cellular modems to transmit operational data to a cloud provider. During the analysis, the team identifies that the cellular modems have no authentication and the cloud storage is misconfigured to allow public read access. Which step of PASTA would the team use to prioritize these risks?

Risk analysis and prioritization

Define the security requirements

An ICS risk assessment team is using the DREAD model to evaluate a threat that could allow an attacker to remotely change a safety system's setpoints. The team assigns scores for damage potential, reproducibility, exploitability, affected users, and discoverability. Which of the following combinations would result in the HIGHEST overall risk score?

High damage, low reproducibility, low exploitability, low affected users, low discoverability

High damage, high reproducibility, high exploitability, high affected users, high discoverability

Low damage, high reproducibility, high exploitability, high affected users, high discoverability

Medium damage, high reproducibility, medium exploitability, medium affected users, high discoverability

A security team is profiling a threat actor that has been observed conducting extensive passive reconnaissance of a power utility's public-facing systems over several months, with no attempts to exploit vulnerabilities. The actor appears to be gathering information about the utility's SCADA vendors and network architecture. Which threat actor profile best matches this behavior?

An insider with legitimate network access

A hacktivist group seeking immediate disruption

A nation-state APT conducting long-term espionage

A script kiddie using automated tools

GIAC Global Industrial Cyber Security Professional

Domain 2Objective 1

Intelligence Gathering & Threat Modeling GICSP Practice Questions (Page 7)

Part of the Threats, Vulnerabilities, and Compromises domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 31–35

31application · medium
During a vulnerability assessment of a food processing plant, a tester discovers that the engineering workstation can reach the PLC subnet directly without traversing any firewall. The workstation also has a default account with a well-known password. Which vulnerability is most critical to remediate first?
Select an answer first
32expert · hard
A threat modeling team is using the PASTA framework to assess a new remote monitoring system for a pipeline. The system uses cellular modems to transmit operational data to a cloud provider. During the analysis, the team identifies that the cellular modems have no authentication and the cloud storage is misconfigured to allow public read access. Which step of PASTA would the team use to prioritize these risks?
Select an answer first
33application · medium
An ICS risk assessment team is using the DREAD model to evaluate a threat that could allow an attacker to remotely change a safety system's setpoints. The team assigns scores for damage potential, reproducibility, exploitability, affected users, and discoverability. Which of the following combinations would result in the HIGHEST overall risk score?
Select an answer first
34foundation · easy
A threat actor is characterized by having high technical capability, significant resources, and a motivation to disrupt a nation's critical infrastructure for political purposes. Which threat actor profile best matches this description?
Select an answer first
35application · medium
A security team is profiling a threat actor that has been observed conducting extensive passive reconnaissance of a power utility's public-facing systems over several months, with no attempts to exploit vulnerabilities. The actor appears to be gathering information about the utility's SCADA vendors and network architecture. Which threat actor profile best matches this behavior?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.

Intelligence Gathering & Threat Modeling GICSP Practice Questions (Page 7)

Questions 31–35

A threat actor is characterized by having high technical capability, significant resources, and a motivation to disrupt a nation's critical infrastructure for political purposes. Which threat actor profile best matches this description?

Keep studying — Threats, Vulnerabilities, and Compromises