A security analyst at a water utility is investigating a suspected intrusion. The analyst has collected a memory image from a compromised operator workstation and captured network traffic. The analyst needs to determine whether the attacker accessed the PLC that controls water pressure. What is the MOST appropriate next step?

Immediately disconnect the PLC from the network to prevent further access

Reboot the workstation and check if the PLC is still responding

Analyze the network traffic for Modbus or DNP3 commands sent to the PLC's IP address

Check the PLC's event log for any changes made during the incident window

What is the main purpose of a post-incident review?

To identify lessons learned and improve future response

To determine the cost of the incident

To delete all evidence related to the incident

In risk-based disaster recovery planning, what is the primary basis for determining the order in which systems and data are recovered?

The order in which systems were installed

The impact on business operations if the system is unavailable

The cost of the hardware and software

The preference of the IT department

A mid-sized brewery has a BIA showing that its fermentation control system has an RTO of 4 hours and an RPO of 1 hour. The brewery has a limited budget and cannot afford a fully redundant hot site. What is the most cost-effective recovery strategy that still meets the RTO and RPO?

A cloud-based site with manual failover and daily snapshots

A cold site with daily backups and no pre-configured hardware

A warm site with pre-configured servers and hourly data replication

A hot site with real-time replication and automatic failover

A malware infection has been confirmed on a packaging line's PLC programming workstation. The workstation is used to modify PLC logic, and the malware appears to be spreading to other engineering workstations. The plant is currently running a production batch that will finish in 4 hours. What is the most appropriate containment action?

Isolate the affected workstation from the network but allow the current batch to finish

Shut down the entire plant immediately to prevent further spread

Disconnect the PLC from the workstation and continue using the workstation

Erase the workstation's hard drive and reinstall the operating system

GIAC Global Industrial Cyber Security Professional

Domain 3Objective 3

Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 8)

Part of the Security Management and Response domain, which makes up ~33% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~23–40 in this domain), expect 8–13 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 36–40

36expert · hard
A security analyst at a water utility is investigating a suspected intrusion. The analyst has collected a memory image from a compromised operator workstation and captured network traffic. The analyst needs to determine whether the attacker accessed the PLC that controls water pressure. What is the MOST appropriate next step?
Select an answer first
37foundation · easy
What is the main purpose of a post-incident review?
Select an answer first
38foundation · easy
In risk-based disaster recovery planning, what is the primary basis for determining the order in which systems and data are recovered?
Select an answer first
39application · medium
A mid-sized brewery has a BIA showing that its fermentation control system has an RTO of 4 hours and an RPO of 1 hour. The brewery has a limited budget and cannot afford a fully redundant hot site. What is the most cost-effective recovery strategy that still meets the RTO and RPO?
Select an answer first
40application · medium
A malware infection has been confirmed on a packaging line's PLC programming workstation. The workstation is used to modify PLC logic, and the malware appears to be spreading to other engineering workstations. The plant is currently running a production batch that will finish in 4 hours. What is the most appropriate containment action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GICSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GICSP” is a trademark of its owner, used for identification only.

Risk Based Disaster Recovery & Incident Response GICSP Practice Questions (Page 8)

Questions 36–40

What is the main purpose of a post-incident review?

In risk-based disaster recovery planning, what is the primary basis for determining the order in which systems and data are recovered?

A mid-sized brewery has a BIA showing that its fermentation control system has an RTO of 4 hours and an RPO of 1 hour. The brewery has a limited budget and cannot afford a fully redundant hot site. What is the most cost-effective recovery strategy that still meets the RTO and RPO?

Keep studying — Security Management and Response