A water utility uses a mix of legacy serial and modern Ethernet-based protocols. The security manager wants to reduce the risk of communication compromises without disrupting operations. Which strategy is most appropriate?

Replace all legacy serial protocols with Ethernet-based protocols immediately.

Encrypt all serial communications with a VPN.

Disable all remote access to the control network.

Deploy a unidirectional gateway between the control network and the corporate network.

A plant's engineering team uses EtherNet/IP for real-time control. They discover that an attacker has been sending CIP messages that cause a PLC to enter a fault state. What is the most likely attack vector?

The attacker is exploiting a vulnerability in the PLC's web server

The attacker is on the same network segment and can send CIP frames directly to the PLC

The attacker is using a serial modem to dial into the PLC's console port

The attacker is physically accessing the PLC's SD card

A manufacturing company uses OPC UA for data exchange between PLCs and MES. The security team wants to mitigate the risk of unauthorized OPC UA commands. Which control is most effective?

Restrict OPC UA traffic to a single VLAN.

Enable OPC UA security policies that require authentication and encryption.

Disable all OPC UA subscriptions and use polling instead.

Use a protocol converter to change OPC UA to Modbus TCP.

Which characteristic of the Modbus protocol makes it particularly susceptible to unauthorized read and write commands from an attacker who gains network access?

It relies on a central master that authenticates every slave device before allowing data exchange.

It uses a broadcast addressing scheme that prevents point-to-point communication between controllers.

It lacks built-in authentication and authorization, allowing any message to be processed as valid.

It uses a proprietary encryption algorithm that is weak and easily broken.

What is a recommended mitigation strategy to protect industrial communication channels from man-in-the-middle attacks?

Disabling all network switches and using only direct serial connections between devices

Using a protocol analyzer to record all traffic for forensic analysis

Using application-layer encryption and authentication, such as TLS or IPsec, for protocol traffic

Increasing the polling frequency of the HMI to detect anomalies faster

GIAC Global Industrial Cyber Security Professional

Domain 2Objective 2

Protocols, Communications, & Compromises GICSP Practice Questions (Page 8)

Part of the Threats, Vulnerabilities, and Compromises domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

4concepts

Questions 36–40

36application · medium
A water utility uses a mix of legacy serial and modern Ethernet-based protocols. The security manager wants to reduce the risk of communication compromises without disrupting operations. Which strategy is most appropriate?
Select an answer first
37application · medium
A plant's engineering team uses EtherNet/IP for real-time control. They discover that an attacker has been sending CIP messages that cause a PLC to enter a fault state. What is the most likely attack vector?
Select an answer first
38application · medium
A manufacturing company uses OPC UA for data exchange between PLCs and MES. The security team wants to mitigate the risk of unauthorized OPC UA commands. Which control is most effective?
Select an answer first
39foundation · easy
Which characteristic of the Modbus protocol makes it particularly susceptible to unauthorized read and write commands from an attacker who gains network access?
Select an answer first
40foundation · easy
What is a recommended mitigation strategy to protect industrial communication channels from man-in-the-middle attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.