Which of the following is an example of active intelligence gathering on an industrial control system?

Monitoring public social media for discussions about ICS vendors

Reading the ICS vendor's product manuals available on their website

Sending a benign query to a PLC using its native protocol to identify the device model

Using Shodan to search for internet-exposed ICS devices

A security engineer is conducting a passive reconnaissance exercise against a municipal water treatment facility. The goal is to identify externally exposed engineering workstation interfaces without sending any packets directly to the facility's OT network. Which approach best achieves this objective?

Query public certificate transparency logs and internet-wide scan databases for IP ranges associated with the facility

Run Nmap with the -sS flag against the facility's public IP range to enumerate open ports

Deploy a network tap on the facility's DMZ switch to capture traffic

Use Shodan to search for the facility's default gateway and then connect to port 502 on that address

Which of the following best describes the purpose of risk prioritization in ICS security?

To eliminate all risks completely

To ignore low-risk vulnerabilities

To transfer all risks to an insurance company

To focus mitigation efforts on the most significant risks

An ICS risk manager is prioritizing risks for a nuclear power plant. The plant has identified the following risks: (1) a nation-state actor could exploit a known vulnerability in the plant's DCS to cause a reactor shutdown, (2) a disgruntled employee could physically damage a backup generator, and (3) a ransomware attack could encrypt the plant's business systems. Which risk should be prioritized first, considering the potential impact on safety and the likelihood of occurrence?

Risk 3, because ransomware is common and could disrupt operations

All risks should be prioritized equally because they all affect the plant

Risk 1, because a nation-state actor has the capability and the impact on safety is catastrophic

Risk 2, because the employee has physical access and the impact is immediate

A security manager is assessing the risk of a disgruntled employee who has access to the control system's engineering workstation. The employee has no network access to the internet but has physical access to the workstation. Which threat actor profile and risk is most relevant?

Cybercriminal; risk of ransomware

Insider threat; risk of unauthorized changes to control logic

Hacktivist; risk of defacing the HMI

Nation-state; risk of espionage

GIAC Global Industrial Cyber Security Professional

Domain 2Objective 1

Intelligence Gathering & Threat Modeling GICSP Practice Questions (Page 8)

Part of the Threats, Vulnerabilities, and Compromises domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 36–40

36foundation · easy
Which of the following is an example of active intelligence gathering on an industrial control system?
Select an answer first
37application · medium
A security engineer is conducting a passive reconnaissance exercise against a municipal water treatment facility. The goal is to identify externally exposed engineering workstation interfaces without sending any packets directly to the facility's OT network. Which approach best achieves this objective?
Select an answer first
38foundation · easy
Which of the following best describes the purpose of risk prioritization in ICS security?
Select an answer first
39expert · hard
An ICS risk manager is prioritizing risks for a nuclear power plant. The plant has identified the following risks: (1) a nation-state actor could exploit a known vulnerability in the plant's DCS to cause a reactor shutdown, (2) a disgruntled employee could physically damage a backup generator, and (3) a ransomware attack could encrypt the plant's business systems. Which risk should be prioritized first, considering the potential impact on safety and the likelihood of occurrence?
Select an answer first
40application · medium
A security manager is assessing the risk of a disgruntled employee who has access to the control system's engineering workstation. The employee has no network access to the internet but has physical access to the workstation. Which threat actor profile and risk is most relevant?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.