20 free GIAC Global Industrial Cyber Security Professional GICSP practice questions from the CertStash pack of 78, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 20 free here, all 78 in the pack, and each step includes the one before it.
Get all 78 questions (US$39) · Download the first 10 as a PDF
Question 1
What is a benefit of log aggregation?
Show answer and explanation
Correct answer: D. Assists in analysis of log data from multiple sources
Log aggregation collects log data from multiple sources into a centralized location, enabling comprehensive analysis across distributed systems. This unified view allows security professionals and administrators to correlate events, identify patterns, and investigate incidents more effectively than examining isolated log sources.
Why the other options are wrong
- A. Log aggregation actually increases initial setup complexity by requiring configuration of multiple log sources and centralized collection infrastructure.
- B. Log aggregation typically increases system load on the centralized logging device rather than reducing it, as it concentrates logs from many sources.
- C. Log aggregation does not eliminate the need for baselining; establishing normal baselines becomes even more critical when analyzing aggregated data from multiple sources.
Question 2
Which command would indicate that a user is attempting to alter the permissions on a Linux file?
Show answer and explanation
Correct answer: B. chmod
The chmod command is used to change file and directory permissions in Linux. It allows users to alter read, write, and execute permissions for owners, groups, and others on filesystem objects.
Why the other options are wrong
- A. The attrib command is a Windows utility for managing file attributes, not a Linux command for altering permissions.
- C. The pwd command prints the working directory path and has no relationship to file permissions.
- D. The md command creates directories in Windows command line and does not alter file permissions.
Question 3
Which type of process performs an action on a set quantity of material at one station before moving it to the next station for another action to be performed on it?
Show answer and explanation
Correct answer: A. Batch
A batch process handles a fixed quantity of material at one workstation, completes all required operations on that batch, then moves the entire batch to the next station for the subsequent operation. This is distinct from continuous processes that flow materials steadily, or discrete processes that handle individual units.
Why the other options are wrong
- B. Hybrid processes combine characteristics of different process types but do not specifically describe the batch movement pattern described.
- C. Continuous processes involve steady material flow without distinct batches stopping at individual stations.
- D. Discrete processes handle individual items or small quantities at individual stations rather than fixed-quantity batches.
Question 4
An organization wants to use Active Directory to manage systems within its Business and Control system networks. Which of the following is the recommended security practice?
Show answer and explanation
Correct answer: C. Separate Active Directory domains for the Business and Control system networks
Separating the Business and Control system networks into distinct Active Directory domains is the recommended security practice. This architectural approach provides isolation, limits the blast radius of potential compromises, enforces separate security policies, and prevents lateral movement between critical operational technology systems and business systems.
Why the other options are wrong
- A. Sharing a single Active Directory domain, even with separate domain controllers, creates a unified trust relationship that compromises network segmentation and increases risk.
- B. Mixing Active Directory with Windows workgroups creates inconsistent management and security policies across the organization.
- D. Sharing an Active Directory domain with Read-Only Domain Controllers still maintains the unified trust and security model, failing to properly segment critical control systems from business networks.
Question 5
Which of the following types of network devices sends traffic only to the intended recipient node?
Show answer and explanation
Correct answer: C. Ethernet switch
An Ethernet switch forwards frames based on MAC addresses, sending traffic only to the specific port where the destination device is located. This unicast forwarding prevents unnecessary broadcast of data to all ports, unlike hubs which flood all traffic to every port.
Why the other options are wrong
- A. Ethernet hubs broadcast incoming frames to all ports regardless of the destination, not just the intended recipient.
- B. Wireless access points broadcast frames to all connected wireless clients and may forward traffic to multiple destinations.
- D. Wireless bridges typically forward traffic between wireless and wired segments, potentially reaching multiple destinations rather than only the intended recipient.
Question 6
What is a use of Network Address Translation?
Show answer and explanation
Correct answer: C. To hide private network addresses
Network Address Translation masks private IP addresses behind public IP addresses, concealing the internal network structure and addresses from external networks. This provides security through obscurity and allows organizations to use private address space internally while presenting a different address externally.
Why the other options are wrong
- A. NAT does not maximize firewall functionality; firewalls operate independently of NAT, though they may work together.
- B. NAT does not simplify access list configuration; it may actually complicate ACL management by translating addresses.
- D. NAT does not enable network routing functionality; routing is a separate layer 3 function that operates independently of address translation.
Question 7
For application-aware firewalls filtering traffic between trust zones, which of the following policies should be applied to a packet that doesn't match an existing rule?
Show answer and explanation
Correct answer: B. Default deny
Application-aware firewalls between trust zones should implement a default deny stance for any traffic that doesn't match an existing rule. This is a fundamental security principle that ensures only explicitly permitted traffic is allowed, protecting the network from unauthorized access and unknown threats.
Why the other options are wrong
- A. Default alert only notifies but doesn't prevent malicious traffic from passing through the firewall.
- C. A deny list is a blacklist approach, less secure than the default deny whitelist model for trust zone boundaries.
- D. A default allow list would permit all unmatched traffic, violating the principle of least privilege.
Question 8
An administrator wants to script the deployment of a security policy, over the network, to a group of workstations not managed by Active Directory. What tool could be used to accomplish this task?
Show answer and explanation
Correct answer: A. secedit.exe
secedit.exe is a command-line tool that allows administrators to script and deploy security policies over the network to multiple workstations. It can be used in batch scripts and remote deployment scenarios, making it suitable for non-AD-managed systems. Unlike the GUI tools, it supports automated, scriptable policy deployment.
Why the other options are wrong
- B. secpol.msc is a GUI management console that cannot be easily scripted for remote deployment across multiple machines.
- C. gpedit.msc is a GUI editor for local group policy and is not designed for remote deployment or scripting.
Question 9
A brewer uses a local HMI to communicate with a controller that opens a pump to move the wort from the boil kettle to the fermentor. What level of the Purdue model would the controller be considered?
Show answer and explanation
Correct answer: B. Level 1
In the Purdue model, Level 1 represents the intelligent devices and controllers that directly interact with the physical process. The pump controller that receives commands from the HMI and directly controls the pump operates at Level 1, as it is the actuating device that manipulates the physical process.
Why the other options are wrong
- A. Level 2 represents the supervisory level with HMIs and SCADA systems, not the direct control equipment.
- C. Level 0 represents the physical process itself (the pump, valves, sensors), not the controller.
- D. Level 3 is the operations/site level with servers and applications.
- E. Level 4 is the enterprise level with corporate systems and business applications.
Question 10
How is a WirelessHART enabled device authenticated?
Show answer and explanation
Correct answer: B. Using a join key to send an encrypted request for the shared network key
WirelessHART devices are authenticated using a join key. When a device joins the network, it uses the join key to send an encrypted request to the network manager to obtain the shared network key, which is then used for ongoing communication. This multi-step key exchange process provides secure network onboarding.
Why the other options are wrong
- A. WirelessHART does not use WPA2 pre-shared keys; it has its own proprietary security mechanisms.
- C. WirelessHART does not rely on a vendor hard-coded master key for authentication.
- D. PIN and MAC address combinations are not part of the WirelessHART authentication mechanism.
What people say about the full Global Industrial Cyber Security Professional GICSP pack 4.5 from 15
GICSP exam dump has proven to be very helpful to me. I studied with it and passed the exam. Thanks to Cert Stash for the excellent service and high-quality GICSP exam dump!
Valid GICSP practice test! Passed the GICSP exam today. Thank you for all of your support!
I failed GICSP exam once for i didn't know there are such wonderful GICSP exam materials to refer to. Then I tried your GICSP study materials and I succeeded. Thank you! Wish you all best!
Question 11
An attacker crafts an email that will send a user to the following site if they click a link in the message. What else is necessary for this type of attack to work? hmi.giac.org/disconnect?sensor=812
Show answer and explanation
Correct answer: C. The user must be authenticated to the HMI interface before clicking the link
For this attack to work, the user must already be authenticated to the HMI interface. The URL parameter 'disconnect?sensor=812' is designed to execute an action on an authenticated session. Without prior authentication, clicking the link alone cannot trigger the action on the HMI system. A session cookie obtained from an authorized user would be helpful but isn't strictly necessary if the victim is already logged in when clicking. Administrator status is not required for this particular action, and script tags are not needed for this type of URL-based attack.
Why the other options are wrong
- A. The attacker doesn't need to obtain a session cookie beforehand if the victim is already authenticated in their browser.
- B. Administrator privileges are not required for the user to execute a sensor disconnect action.
- D. Script tags are not necessary for executing URL parameters; this is a direct HTTP request attack, not an XSS attack.
Question 12
An attacker has a goal of obtaining information stored in an ICS. Why might the attacker focus his efforts on the operating system rather than the ICS application?
Show answer and explanation
Correct answer: D. Control of the operating system offers access to applications running on it
Control of the operating system provides a privileged position from which an attacker can access all applications and data running on that OS, including the ICS application. This single point of compromise gives broader access than targeting the application alone. While option A may reflect real-world neglect, it is not the strategic reason for preferring OS attacks; option B is false because operating systems typically have more vulnerabilities, not fewer; option C is backwards, as ICS applications typically have more hardening guidance than generic operating systems.
Why the other options are wrong
- A. While organizational gaps may exist, this is not the primary strategic reason attackers target the OS.
- B. Operating systems generally have more, not fewer, vulnerabilities than specialized ICS applications.
- C. ICS applications typically receive more vendor hardening guidance than commodity operating systems do.
Question 13
Which of the following is a containment task within the six step incident handling process?
Show answer and explanation
Correct answer: B. Creating a forensic image of a compromised workstation
In the six step process, containment includes short term actions and taking a backup, which means creating a forensic image of the compromised system before anything is changed. This preserves evidence while the incident is being contained.
Why the other options are wrong
- A. Checking that patches were deployed belongs to preparation or recovery, not containment.
- C. Re-imaging an infected workstation removes the threat, which is part of eradication.
- D. Validating a fix with a vulnerability scan is part of recovery, after eradication is complete.
Question 14
What can be configured on the router so that it can most effectively implement and enforce zones for the shown subnets?
Show answer and explanation
Correct answer: B. Access control lists
Access control lists (ACLs) are the most effective tool for implementing and enforcing zones across the subnets shown in the diagram. ACLs operate at Layer 3 (network layer) on routers and can define granular rules that control traffic between different subnets and security zones (Instrumentation LAN, Control Devices LAN, Supervisory Control LAN, and Operations Support DMZ). By configuring ACLs on router interfaces, you can permit or deny traffic based on source/destination IP addresses, protocols, and ports, thereby enforcing the logical separation and security policies required for each zone. This approach provides centralized control at the network perimeter and scales effectively across multiple subnets.
Why the other options are wrong
- A. MAC-based port security operates at Layer 2 and controls individual switch ports, not traffic between subnets; it cannot enforce zone-level segmentation across the routed network architecture shown.
- C. Secure Shell (SSH) is a remote access protocol for secure management connections, not a mechanism for implementing network zones or traffic control between subnets.
- D. 802.1x is an authentication protocol for controlling port access based on device credentials; it does not provide the traffic filtering and zone enforcement capabilities needed for network segmentation.
Question 15
What is a recommended practice for configuring enforcement boundary devices in an ICS control network?
Show answer and explanation
Correct answer: A. Create a rule which drops inbound packets containing a source address from within the protected network
Creating a rule that drops inbound packets with source addresses from within the protected network is a recommended practice that prevents spoofed traffic and enforces network segmentation. This rule protects against attacks originating from within the control network attempting to masquerade as external traffic.
Why the other options are wrong
- B. Full packet collection on all rules creates excessive data overhead and is not a focused security recommendation.
- C. Stateless ACLs are inefficient for ICS control networks; stateful inspection is the recommended modern approach.
- D. An egress policy allowing everything except explicitly denied items is too permissive and violates the principle of least privilege.
Question 16
Which control helps prevent threats to Integrity?
Show answer and explanation
Correct answer: D. Implementing digital signatures
Digital signatures provide cryptographic verification that data has not been modified and confirm the identity of the data sender. This directly protects data integrity by detecting any unauthorized changes and ensuring the authenticity of transmitted information.
Why the other options are wrong
- A. Firewall egress filtering controls network traffic flow but does not specifically protect data integrity from modification.
- B. Logging IDS alerts records security events but does not prevent or detect data integrity violations directly.
- C. Centralized LDAP authentication ensures user identity verification and access control, which relates to availability and confidentiality more than integrity.
Question 17
What should be considered when implementing fieldbus protocols over an Ethernet network?
Show answer and explanation
Correct answer: D. Different protocols will need a bridging device to talk to each other
When implementing multiple fieldbus protocols over a shared Ethernet infrastructure, different protocols require bridging devices to enable communication and interoperability between systems using distinct communication standards. This allows heterogeneous devices to coexist and communicate on the same network.
Why the other options are wrong
- A. Modern Ethernet networks support concurrent multi-point communications, not single-host-at-a-time restrictions.
- B. Multiple protocols can route across the same Ethernet infrastructure with proper configuration and bridging.
- C. Ethernet networks can be segmented into subnets and VLANs regardless of the fieldbus protocols in use.
Question 18
Which type of process is described below? A fermentor's glycol jacket must maintain a steady temperature during and between batches of beer.
Show answer and explanation
Correct answer: A. Continuous
A continuous process is one that operates without interruption, maintaining steady-state conditions. The glycol jacket maintaining a constant temperature throughout and between batches exemplifies continuous process control, where the system continuously regulates a parameter without discrete start/stop cycles.
Why the other options are wrong
- B. Manual processes require human intervention and control, not automated regulation.
- C. Discrete processes handle distinct, separate items or batches with defined start and end points, not continuous steady-state maintenance.
- D. Batch processes produce fixed quantities per cycle, though the temperature control itself is continuous rather than batch-oriented.
Question 19
What kind of data could be found on a historian?
Show answer and explanation
Correct answer: A. Information needed for billing customers
A historian in SCADA systems stores historical time-series data collected from the control systems, which is used for analysis, reporting, and billing purposes. This data tracks process parameters and operations over time and is essential for billing customers based on actual usage and production metrics.
Why the other options are wrong
- B. Real-time supervision of controllers is handled by HMIs and SCADA systems, not historians which store historical data.
- C. Process diagrams are typically stored in documentation systems or engineering tools, not in the historian database.
- D. Runtime libraries are part of the operating system and application software infrastructure, not historian storage.
Question 20
Which type of device is the following configuration setting from? deny modbus function write-multiple-holdingregisters
Show answer and explanation
Correct answer: D. Application firewall
This configuration rule is from an application firewall because it specifically blocks a Modbus function (write-multiple-holdingregisters) at the application protocol level. Modbus is an industrial protocol, and the rule is filtering based on the specific function call within that protocol. A NIDS would detect and alert on such traffic but wouldn't actively block it with this syntax. A network firewall operates at lower layers and wouldn't have Modbus protocol awareness. A SIEM collects and analyzes logs rather than enforcing protocol-level controls.
Why the other options are wrong
- A. Network firewalls operate at the network layer and don't have Modbus protocol awareness for function-level blocking.
- B. A NIDS detects and alerts but doesn't actively enforce deny rules on specific protocol functions.
- C. A SIEM is a logging and analysis tool, not an enforcement device that blocks specific protocol functions.
That was 20 of 78.
The full GIAC Global Industrial Cyber Security Professional GICSP pack has all 78 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 40 free as one PDF by email. Get the Half Pack →