A Level 3 MES needs real-time production counts from a Level 2 SCADA system. The network team wants to minimize the attack surface. What is the recommended approach?

Use a wireless bridge to connect the two levels

Have the MES poll the PLCs directly over the control network

Allow bidirectional communication between Level 2 and Level 3 on the same subnet

Use a unidirectional gateway to send data from Level 2 to Level 3

A company is integrating its Level 3 MES with a cloud-based analytics platform. The security team is concerned about data exfiltration and unauthorized access. The MES must send production data to the cloud, but the control network must remain isolated. What is the best approach?

Place the cloud analytics platform on the same network as the MES

Connect the MES directly to the cloud via a VPN

Use a DMZ with a unidirectional gateway from the MES to the cloud, and allow no return traffic

Use a bidirectional firewall rule between the MES and cloud

A plant has a policy that all USB ports on Level 2 HMIs must be disabled. An operator needs to transfer a recipe file from a USB drive to the HMI. What is the most secure way to accomplish this?

Temporarily enable the USB port, transfer the file, then disable it again

Have the operator manually enter the recipe data into the HMI

Email the recipe file to the HMI's email client

Use a one-way transfer mechanism, such as a data diode, to move the file from a secure workstation to the HMI

A beverage bottling plant has a Level 2 supervisory system that collects data from line controllers and sends it to a Level 3 historian. The plant wants to add a new line and needs to ensure the data flow is reliable and secure. Which design should be implemented?

Use wireless sensors to send data directly to the historian.

Have the historian poll the controllers using Modbus TCP over the internet.

Use a dedicated control network with OPC UA and a firewall between Level 2 and Level 3.

Connect the new line's controllers directly to the corporate network for simplicity.

An operator at a pipeline facility uses a local operator interface (LOI) to manually open a valve. The LOI is a dedicated panel with a touchscreen. An attacker gains remote access to the LOI through a misconfigured remote desktop service. What is the most direct operational impact the attacker can cause?

The attacker can reprogram the PLC's logic to change the control algorithm.

The attacker can manipulate the valve position, causing unsafe pressure conditions.

The attacker can steal the operator's credentials for the corporate network.

The attacker can modify the historian's archived data to hide the attack.

GIAC Global Industrial Cyber Security Professional

Domain 1Objective 4

PERA Level 2 & 3 Technology Overview and Compromise GICSP Practice Questions (Page 1)

Part of the ICS Fundamentals and Architecture domain, which makes up ~40% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~28–48 in this domain), expect 7–12 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

7concepts

Questions 1–5

1application · medium
A Level 3 MES needs real-time production counts from a Level 2 SCADA system. The network team wants to minimize the attack surface. What is the recommended approach?
Select an answer first
2expert · hard
A company is integrating its Level 3 MES with a cloud-based analytics platform. The security team is concerned about data exfiltration and unauthorized access. The MES must send production data to the cloud, but the control network must remain isolated. What is the best approach?
Select an answer first
3application · medium
A plant has a policy that all USB ports on Level 2 HMIs must be disabled. An operator needs to transfer a recipe file from a USB drive to the HMI. What is the most secure way to accomplish this?
Select an answer first
4application · medium
A beverage bottling plant has a Level 2 supervisory system that collects data from line controllers and sends it to a Level 3 historian. The plant wants to add a new line and needs to ensure the data flow is reliable and secure. Which design should be implemented?
Select an answer first
5application · medium
An operator at a pipeline facility uses a local operator interface (LOI) to manually open a valve. The LOI is a dedicated panel with a touchscreen. An attacker gains remote access to the LOI through a misconfigured remote desktop service. What is the most direct operational impact the attacker can cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.