A manufacturing plant uses PROFINET for real-time control. A security analyst suspects that an attacker is injecting false process data into the network. Which characteristic of PROFINET makes this type of communication compromise particularly feasible?

PROFINET devices cannot be configured with IP addresses.

PROFINET frames are not encrypted or authenticated by default.

PROFINET uses a proprietary physical layer that is difficult to monitor.

PROFINET requires a dedicated fiber-optic link between devices.

A food processing plant uses a mix of legacy and modern control systems. The plant is connected to the corporate network for reporting. An attacker has compromised a server on the corporate network and is using it to send malicious commands to the plant's PLCs. Which attack vector is being used, and what is the most effective mitigation?

Direct physical access to the PLCs; implement stronger physical security.

Exploiting a vulnerability in the PLC firmware; apply firmware patches.

Lateral movement from the corporate network; deploy a firewall with strict allowlists between the networks.

Social engineering of plant operators; conduct security awareness training.

Which attack vector is commonly used to gain initial access to an industrial control system network by exploiting a vulnerability in a protocol that is exposed to the internet?

Using a Bluetooth vulnerability to pair with the PLC from outside the facility

Inserting a USB drive into the HMI to install a new operating system

Sending a malicious email attachment to the PLC's embedded email client

Direct exploitation of the Modbus TCP port from an internet-facing device

A plant's engineering workstation is infected with malware that is actively scanning for PROFINET devices. The security team wants to detect the scan and prevent the malware from communicating with any PROFINET device. They have a next-generation firewall that supports PROFINET inspection. What is the best action?

Disconnect the engineering workstation from the network

Enable PROFINET device LLDP to improve discovery

Change the PROFINET device names

Configure the firewall to block all PROFINET traffic from the engineering workstation and enable an alert on scan attempts

A manufacturing plant uses PROFINET for real-time control and OPC UA for data collection. The security team wants to mitigate protocol vulnerabilities without affecting production. Which approach is most effective?

Replace PROFINET with OPC UA to gain built-in security.

Disable OPC UA and use only PROFINET for all communications.

Implement network segmentation and an industrial firewall that filters both PROFINET and OPC UA traffic.

Encrypt all PROFINET traffic with a VPN.

GIAC Global Industrial Cyber Security Professional

Domain 2Objective 2

Protocols, Communications, & Compromises GICSP Practice Questions (Page 7)

Part of the Threats, Vulnerabilities, and Compromises domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

4concepts

Questions 31–35

31application · medium
A manufacturing plant uses PROFINET for real-time control. A security analyst suspects that an attacker is injecting false process data into the network. Which characteristic of PROFINET makes this type of communication compromise particularly feasible?
Select an answer first
32expert · hard
A food processing plant uses a mix of legacy and modern control systems. The plant is connected to the corporate network for reporting. An attacker has compromised a server on the corporate network and is using it to send malicious commands to the plant's PLCs. Which attack vector is being used, and what is the most effective mitigation?
Select an answer first
33foundation · easy
Which attack vector is commonly used to gain initial access to an industrial control system network by exploiting a vulnerability in a protocol that is exposed to the internet?
Select an answer first
34expert · hard
A plant's engineering workstation is infected with malware that is actively scanning for PROFINET devices. The security team wants to detect the scan and prevent the malware from communicating with any PROFINET device. They have a next-generation firewall that supports PROFINET inspection. What is the best action?
Select an answer first
35expert · hard
A manufacturing plant uses PROFINET for real-time control and OPC UA for data collection. The security team wants to mitigate protocol vulnerabilities without affecting production. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.

Protocols, Communications, & Compromises GICSP Practice Questions (Page 7)

Questions 31–35

A manufacturing plant uses PROFINET for real-time control. A security analyst suspects that an attacker is injecting false process data into the network. Which characteristic of PROFINET makes this type of communication compromise particularly feasible?

Which attack vector is commonly used to gain initial access to an industrial control system network by exploiting a vulnerability in a protocol that is exposed to the internet?

A manufacturing plant uses PROFINET for real-time control and OPC UA for data collection. The security team wants to mitigate protocol vulnerabilities without affecting production. Which approach is most effective?

Keep studying — Threats, Vulnerabilities, and Compromises