GIAC GICSP Practice Test Questions Answers

Comprehensive and Detailed Explanation From Exact Extract:

In the context ofIndustrial Control Systems (ICS)andOT network security, the principle of least privilege and explicit access control is fundamental for protecting critical infrastructure assets. According to the GICSP framework, when usingapplication-aware firewallsbetween different trust zones (e.g., corporate network to OT network), any traffic that doesnot explicitly match a defined ruleshould be blocked by default. This is referred to as the“default deny” policy.

Default denymeans that unless traffic is explicitly allowed by firewall rules, it should be denied. This ensures that no unknown or unauthorized packets traverse trust boundaries, reducing the attack surface significantly.

Thedefault alertoption (A) is useful for monitoring but does not prevent unauthorized access, so it’s insufficient as a security control.

Application deny list(C) andapplication allow list(D) refer to sets of permitted or denied applications, but the firewall still needs an overarching policy to handle unmatched packets; that policy must be deny for safety.

This approach is emphasized in theICS Security Architecture and Network Segmentationdomain of GICSP, reinforcing that all unknown or unexpected network traffic should be blocked unless explicitly permitted by policy. This aligns withNIST SP 800-82 Rev 2guidance on ICS security, which GICSP incorporates.

An industrial historian is a specialized database system designed to collect, store, and retrieve time-series data from industrial control systems. It primarily stores process data, event logs, and measurements over time, which are essential for trend analysis, reporting, and regulatory compliance.

Historian data is often used for billing purposes (A), especially in utilities and process industries, where consumption data is recorded and later used to generate customer bills.

Option (B), real-time supervision of lower-level controllers, is typically handled by SCADA or control system software, not the historian itself.

(C) Diagrams are stored in engineering tools or documentation repositories, not historians.

(D) Runtime libraries are software components and not stored on historians.

The GICSP curriculum clarifies that historians are central to operational analytics and long-term data storage but are not real-time control systems themselves.

A Guideline (A) provides general recommendations and best practices without mandatory requirements or detailed instructions.

Procedures (B) are step-by-step instructions for specific tasks.

Standards (C) specify mandatory requirements, often with measurable criteria.

Policies (D) establish high-level organizational directives and rules.

Martin’s document provides general, non-mandatory advice applicable broadly, fitting the definition of a guideline.

In risk analysis, high consequence, low probability risks—such as catastrophic failures or attacks—require special attention. The best approach to ensure these risks are properly considered is to prioritize risks based on impact (A), focusing on the potential severity of consequences if the event occurs, regardless of its frequency.

Giving frequency or likelihood (B, D) a higher weight can lead to underestimating rare but highly damaging risks.

Mitigation cost (C) is a factor in decision-making but does not ensure identification or prioritization of high-impact risks.

GICSP emphasizes a balanced risk management process where impact or consequence is a critical criterion, especially in ICS environments where safety and critical infrastructure availability are paramount.

A keyed lock is a delaying control (D) because it physically slows down or impedes unauthorized access to a facility, giving security personnel more time to respond.

Avoidant controls (A) prevent risk by eliminating it.

Responsive controls (B) act after an incident occurs.

Corrective controls (C) fix or restore systems after an incident.

GICSP emphasizes physical delaying controls as part of defense-in-depth strategies.