A pharmaceutical plant's control network is connected to the corporate network via a firewall. An attacker compromises a corporate workstation and uses it to send OPC UA commands to the plant's historian. Which attack vector is being used?

Direct physical access to the control network.

Pivoting from the corporate network to the control network.

Social engineering of plant operators.

Exploiting a vulnerability in the OPC UA protocol itself.

Which mitigation strategy is most effective in reducing the risk of protocol-based attacks on an industrial control system that uses legacy protocols like Modbus?

Enabling debug logging on all PLCs to capture attack attempts

Segmenting the network and placing firewalls between the IT and OT zones

Replacing all Ethernet cables with fiber optic cables to prevent tapping

Increasing the baud rate on serial communication links to reduce latency

A pipeline operator uses a satellite link to communicate with remote pumps via Modbus TCP. The link is expensive and has high latency. The security team suspects an attacker is replaying old Modbus frames to open a valve. They need to prevent replay without adding significant latency or cost. What is the most effective mitigation?

Implement a sequence number and timestamp check in a protocol gateway at each end

Increase the satellite bandwidth to reduce latency

Disable remote access to the pumps

A power utility uses DNP3 over TCP/IP. The security team wants to detect an attacker who is replaying old DNP3 messages to open a breaker. They have a network tap and a server that can run software. What is the most effective detection method?

Deploy a software-based IDS that checks DNP3 sequence numbers and timestamps

Use a firewall to block all DNP3 traffic

Monitor the network for high traffic volume

Enable DNP3 encryption on the existing RTUs

A power utility uses IEC 60870-5-104 to communicate between a control center and substation RTUs. An attacker performs a man-in-the-middle attack, intercepting and modifying the telemetry data. What is the most direct impact of this compromise?

The operator receives false status information, leading to incorrect decisions

The RTU's physical relays are damaged

The control center loses all network connectivity

The RTU's firmware is overwritten with malicious code

GIAC Global Industrial Cyber Security Professional

Domain 2Objective 2

Protocols, Communications, & Compromises GICSP Practice Questions (Page 3)

Part of the Threats, Vulnerabilities, and Compromises domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

4concepts

Questions 11–15

11application · medium
A pharmaceutical plant's control network is connected to the corporate network via a firewall. An attacker compromises a corporate workstation and uses it to send OPC UA commands to the plant's historian. Which attack vector is being used?
Select an answer first
12foundation · easy
Which mitigation strategy is most effective in reducing the risk of protocol-based attacks on an industrial control system that uses legacy protocols like Modbus?
Select an answer first
13expert · hard
A pipeline operator uses a satellite link to communicate with remote pumps via Modbus TCP. The link is expensive and has high latency. The security team suspects an attacker is replaying old Modbus frames to open a valve. They need to prevent replay without adding significant latency or cost. What is the most effective mitigation?
Select an answer first
14expert · hard
A power utility uses DNP3 over TCP/IP. The security team wants to detect an attacker who is replaying old DNP3 messages to open a breaker. They have a network tap and a server that can run software. What is the most effective detection method?
Select an answer first
15application · medium
A power utility uses IEC 60870-5-104 to communicate between a control center and substation RTUs. An attacker performs a man-in-the-middle attack, intercepting and modifying the telemetry data. What is the most direct impact of this compromise?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.