10 free GIAC Global Industrial Cyber Security Professional GICSP practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 78 questions. Work through them, then open each answer to check your reasoning.
Get all 78 questions (US$39) · Download these 10 as a PDF
Question 1
For application-aware firewalls filtering traffic between trust zones, which of the following policies should be applied to a packet that doesn't match an existing rule?
Show answer and explanation
Correct answer: B. Default deny
An application-aware firewall separating trust zones should end its rule base with an implicit or explicit default deny, so any packet that matches no rule is dropped. This enforces least privilege and forces administrators to explicitly authorize every flow that crosses the zone boundary. Default deny gives the most secure baseline and also produces cleaner logging of unexpected traffic.
Why the other options are wrong
- A. Default alert only generates a notification and still lets unmatched, potentially malicious traffic pass.
- C. An application deny list blocks only the applications it names, so anything not listed is still allowed through.
- D. An application allow list describes which applications are permitted by rule, but the question asks for the action taken when no rule matches at all.
Question 2
An administrator wants to script the deployment of a security policy, over the network, to a group of workstations not managed by Active Directory.
What tool could be used to accomplish this task?
Show answer and explanation
Correct answer: A. secedit.exe
is the command line security configuration tool that applies a security template to a system, so it can be called from a script and run remotely against workstations with no Active Directory membership. Administrators commonly pair it with a remote execution method such as PsExec or WinRM to push the same INF template to a group of standalone machines. The other tools are interactive consoles limited to the local computer.
Why the other options are wrong
- B. secpol.msc is a graphical console for editing local security policy on one machine and offers no scripting or deployment capability.
- C. gpedit.msc edits Local Group Policy through a GUI on a single computer, so it cannot be scripted to deploy a policy across the network.
Question 3
A brewer uses a local HMI to communicate with a controller that opens a pump to move the wort from the boil kettle to the fermentor.
What level of the Purdue model would the controller be considered?
Show answer and explanation
Correct answer: B. Level 1
In the Purdue model, Level 1 is basic control: the PLCs, RTUs and DCS controllers that read field signals and issue commands to the process. The controller driving the pump that moves wort from the boil kettle to the fermentor performs that basic control function, so it sits at Level 1. The local HMI talking to it belongs at Level 2, and the pump itself is the Level 0 field device.
Why the other options are wrong
- A. Level 2 is area supervisory control, covering HMIs, SCADA servers and operator workstations rather than the controller itself.
- C. Level 0 is the physical process and its field devices such as the pump, valves and sensors, not the logic controller commanding them.
- D. Level 3 is site operations, including manufacturing execution systems, historians and production scheduling.
- E. Level 4 is the enterprise business network with ERP and corporate IT systems.
Question 4
How is a WirelessHART enabled device authenticated?
Show answer and explanation
Correct answer: B. Using a join key to send an encrypted request for the shared network key
WirelessHART devices are authenticated using a join key, which is a pre-shared secret used by the device to send an encrypted request to the network manager. The network manager responds with the shared network key, allowing the device to join the network securely. This method does not rely on WPA2 pre-shared keys or vendor master keys.
Why the other options are wrong
- A. WirelessHART does not use WPA2 pre-shared key authentication; it uses industria-rade security mechanisms specific to HART protocol.
- C. WirelessHART does not use vendor hard-coded master keys; it uses administrato-rovisioned join keys.
- D. WirelessHART authentication does not involve PIN and MAC address combinations.
Question 5
Which type of process is described below?
A fermentor's glycol jacket must maintain a steady temperature during and between batches of beer.
Show answer and explanation
Correct answer: A. Continuous
A continuous process maintains steady-state conditions over time, such as a glycol jacket maintaining a constant temperature throughout and between batches. The process continuously regulates temperature to keep it stable, rather than having discrete start-an-top steps or manual intervention.
Why the other options are wrong
- B. Manual process describes operations requiring operator intervention, while the glycol jacket operates automatically to maintain temperature.
- C. Discrete process involves distinct, separate steps with clear start and end points, whereas temperature maintenance is ongoing.
- D. Batch process involves repeated cycles of distinct production runs, but the temperature control itself is continuous during each batch.
Question 6
What kind of data could be found on a historian?
Show answer and explanation
Correct answer: A. Information needed for billing customers
A historian is a database system that stores time-series data collected from SCADA systems and controllers. This historical data includes production metrics, operational parameters, and performance information used for billing customers based on production quantities, energy consumption, and other measurable outputs.
Why the other options are wrong
- B. Real-time supervision of lower-level controllers is the function of supervisory control systems (SCADA) itself, not the historian.
- C. Process diagrams are typically stored in engineering systems or documentation repositories, not in historian databases.
- D. Runtime libraries are software components used by applications, not data stored in industrial historians.
Question 7
Which of the following can an attacker gain by obtaining PLC logic project files for a SCADA system?
Show answer and explanation
Correct answer: B. Details about the network architecture
PLC logic project files contain detailed information about how the system operates, including control sequences, sensor inputs, output commands, and communication patterns between devices. From this, an attacker can reverse-engineer the network architecture, understand device relationships, identify critical systems, and determine communication flows between PLCs, HMIs, and other components.
Why the other options are wrong
- A. Personnel and hiring information would not be found in PLC logic project files; these are operational automation files.
- C. Firewall rulesets are network security configurations separate from PLC logic files.
- D. Vendor product release schedules are not contained within PLC project files.
Question 8
Which control helps prevent threats to Integrity?
Show answer and explanation
Correct answer: D. Implementing digital signatures
Digital signatures protect integrity by cryptographically binding data to its origin and detecting any unauthorized modifications. When data is signed, any tampering produces a signature verification failure, ensuring that data has not been altered since it was signed. This directly prevents integrity threats.
Why the other options are wrong
- A. Firewall egress filtering protects confidentiality and availability by controlling outbound traffic, not integrity.
- B. Logging IDS alerts provides detection and forensics after an integrity breach has occurred, not prevention.
- C. Centralized LDAP authentication controls access (authorization and authentication) but does not prevent modifications to data.
Question 9
What mechanism could help defeat an attacker's attempt to hide evidence of his/her actions on the target system?
Show answer and explanation
Correct answer: D. Centralized logging
Centralized logging creates a remote, independent record of system activities that an attacker cannot easily modify or delete from the target system itself. Even if an attacker covers their tracks locally by clearing logs, centralized logging maintains evidence on a separate system, defeating the attacker's attempt to hide their actions. This is a fundamental defensive measure against log tampering and evidence destruction.
Why the other options are wrong
- A. Attack surface analysis identifies potential vulnerabilities but does not preserve evidence of attacker actions.
- B. Application allow lists prevent unauthorized applications from running but do not create audit trails of attempted intrusions.
- C. Sandboxing isolates applications but does not inherently preserve evidence of actions that occurred outside the sandbox.
Question 10
An attacker has a goal of obtaining information stored in an ICS.
Why might the attacker focus his efforts on the operating system rather than the ICS application?
Show answer and explanation
Correct answer: D. Control of the operating system offers access to applications running on it
Control of the operating system provides privileged access to all applications and data running on that system, including the ICS application. Once an attacker gains OS-level control, they can bypass application-level security, access sensitive data, and manipulate or monitor the ICS application. The operating system is the foundation layer that all applications depend upon, making it an efficient target for comprehensive system compromise.
Why the other options are wrong
- A. While OS neglect can be a problem, it is not the primary reason attackers target the OS for accessing ICS information.
- B. ICS applications typically have fewer vulnerabilities than operating systems due to their specialized, limited functionality.
- C. This is backwards; ICS applications typically have more vendor-provided security guidance than general-purpose operating systems.
That was 10 of 78.
The full GIAC Global Industrial Cyber Security Professional GICSP pack has all 78 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.