A power utility uses IEC 61850 GOOSE messages for protection. The security team wants to detect if an attacker is injecting false GOOSE messages. Which approach is most effective?

Deploy network monitoring that analyzes GOOSE message patterns and alerts on anomalies.

Disable GOOSE and use a different protocol.

Use a firewall to block all multicast traffic.

Encrypt GOOSE messages with a VPN.

A power plant's control network uses IEC 60870-5-104 for communication with substations. An attacker has gained access to the network and is sending control commands to open a circuit breaker. Which attack vector is being used?

Physical attack on the circuit breaker.

Denial-of-service attack on the substation's communication link.

Social engineering of the substation operator.

Injection of malicious IEC 60870-5-104 messages.

A power utility uses IEC 61850 GOOSE messages for protection tripping. The security team wants to reduce the risk of an attacker injecting false GOOSE messages. Which mitigation is most effective for this specific protocol?

Enable GOOSE message authentication using IEC 62351-6.

Use a firewall to block all multicast traffic.

Disable unused ports on the switches.

Segment the network with VLANs to separate GOOSE traffic.

A chemical plant uses PROFINET IO for real-time control. The security team wants to detect an attacker who has gained access to the control network and is sending malicious PROFINET frames. Which approach provides the earliest detection?

Configure the PLC to reject all PROFINET frames from unknown IP addresses

Review controller logs weekly for alarms

Enable switch port security to limit MAC addresses per port

Deploy an industrial IDS that monitors PROFINET DCP and IO frames for anomalies

GIAC Global Industrial Cyber Security Professional

Domain 2Objective 2

Protocols, Communications, & Compromises GICSP Practice Questions (Page 5)

Part of the Threats, Vulnerabilities, and Compromises domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

4concepts

Questions 21–25

21expert · hard
A power utility uses IEC 61850 GOOSE messages for protection. The security team wants to detect if an attacker is injecting false GOOSE messages. Which approach is most effective?
Select an answer first
22application · medium
A power plant's control network uses IEC 60870-5-104 for communication with substations. An attacker has gained access to the network and is sending control commands to open a circuit breaker. Which attack vector is being used?
Select an answer first
23application · medium
A power utility uses IEC 61850 GOOSE messages for protection tripping. The security team wants to reduce the risk of an attacker injecting false GOOSE messages. Which mitigation is most effective for this specific protocol?
Select an answer first
24application · medium
A malware sample is found on a laptop that was used to configure a PLC. The malware is known to send specially crafted packets to port 102. Which protocol is the malware targeting?
Select an answer first
25application · medium
A chemical plant uses PROFINET IO for real-time control. The security team wants to detect an attacker who has gained access to the control network and is sending malicious PROFINET frames. Which approach provides the earliest detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.