A vulnerability scan of a wastewater treatment plant identifies that the PLC firmware is outdated and has known vulnerabilities. The plant cannot take the PLC offline for patching during operation. Which of the following is the most appropriate compensating control to reduce the risk?

Implement network segmentation to limit access to the PLC

Increase the frequency of backups

A penetration tester is asked to perform active reconnaissance on a natural gas pipeline's OT network. The client has approved scanning the DMZ and OT segments, but explicitly prohibits any technique that could cause a denial of service. Which scanning approach should the tester use?

Send a large number of ICMP echo requests to map the network

TCP connect scans with a low rate limit and no unsafe probes

Use aggressive Nmap timing templates to speed up the scan

UDP scans with many malformed packets to enumerate services

A security analyst is performing passive reconnaissance on a target industrial organization. The analyst wants to identify the types of PLCs and RTUs in use without sending any packets directly to the target's network. Which technique is most appropriate for this goal?

Deploying a network tap on the target's OT network

Querying Shodan for internet-exposed devices

Using the Metasploit modbus scanner module

Running Nmap with the -sS flag against the target's public IP range

Which of the following is a common vulnerability in industrial control systems that can be exploited by sending specially crafted network packets to a PLC?

Cross-site scripting in the engineering workstation

Buffer overflow in the PLC's protocol parser

Weak password on the office email server

SQL injection in the HMI database

GIAC Global Industrial Cyber Security Professional

Domain 2Objective 1

Intelligence Gathering & Threat Modeling GICSP Practice Questions (Page 9)

Part of the Threats, Vulnerabilities, and Compromises domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 41–44

41application · medium
A vulnerability scan of a wastewater treatment plant identifies that the PLC firmware is outdated and has known vulnerabilities. The plant cannot take the PLC offline for patching during operation. Which of the following is the most appropriate compensating control to reduce the risk?
Select an answer first
42application · medium
A penetration tester is asked to perform active reconnaissance on a natural gas pipeline's OT network. The client has approved scanning the DMZ and OT segments, but explicitly prohibits any technique that could cause a denial of service. Which scanning approach should the tester use?
Select an answer first
43application · medium
A security analyst is performing passive reconnaissance on a target industrial organization. The analyst wants to identify the types of PLCs and RTUs in use without sending any packets directly to the target's network. Which technique is most appropriate for this goal?
Select an answer first
44foundation · easy
Which of the following is a common vulnerability in industrial control systems that can be exploited by sending specially crafted network packets to a PLC?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.