GICSPPreview

An organization has their ICS operations and networking equipment installed in the Purdue model level 3. Where should the SIEM for this equipment be placed in relation to the existing Level 3 devices?

Which of the following is typically performed during the Recovery phase of incident response?

What is an output of a Business Impact Analysis?

Which of the following devices would indicate an enforcement boundary?

Which of the following devices is most likely to be in the same level as an HMI workstation that interfaces with a PLC?

What is a recommended practice for securing historians and databases whose purpose is to feed data back into the control processes?

An attacker crafts an email that will send a user to the following site if they click a link in the message. What else is necessary for this type of attack to work? hmi.giac.org/disconnect?sensor=812

An attacker has a goal of obtaining information stored in an ICS. Why might the attacker focus his efforts on the operating system rather than the ICS application?

For application-aware firewalls filtering traffic between trust zones, which of the following policies should be applied to a packet that doesn't match an existing rule?

What kind of data could be found on a historian?

Which type of process is used to manufacture fuels, chemicals, and plastics?

In the context of ICS the process of fuzzing a device is described as which of the following?

Which of the following is part of the Respond function of the NIST CSF (cybersecurity framework)?

Which of the following is located in user mode of a typical real-time OS, but in kernel mode of a typical standard OS?

Which type of process performs an action on a set quantity of material at one station before moving it to the next station for another action to be performed on it?

Which type of process is described below?
Ten barrels of hot water is moved from the hot liquor tank to the mash tun.
500 kg of milled grist is added to the mash tun.
The mixture is maintained for 60 minutes before being drained to the boil kettle.

What approach can an organization use to make sure that high consequence, low probability risks are considered during risk analysis?

Which of the following can an attacker gain by obtaining PLC logic project files for a SCADA system?

What mechanism could help defeat an attacker's attempt to hide evidence of his/her actions on the target system?

Which control helps prevent threats to Integrity?

Which resource includes a standardized categorization of common software vulnerabilities?

How are general purpose Programmable Logic Controllers (PLC) different than smart field devices?

An administrator wants to script the deployment of a security policy, over the network, to a group of workstations not managed by Active Directory. What tool could be used to accomplish this task?

A brewer uses a local HMI to communicate with a controller that opens a pump to move the wort from the boil kettle to the fermentor. What level of the Purdue model would the controller be considered?