GICSP questions and answers

For application-aware firewalls filtering traffic between trust zones, which of the following policies should be applied to a packet that doesn't match an existing rule?

Which characteristic best explains why patch management in ICS environments often differs from traditional IT environments?

What is an output of a Business Impact Analysis?

An incident responder identifies unusual but authorized Modbus read requests occurring at abnormal times.

Which security principle is most likely being violated?

At which offset of ~/GIAC/memdump/raw_key_13 does binwalk indicate is the beginning of the binary file?

Based on the following diagram, how many Active Directory domains should be created for this network?

What is a benefit of log aggregation?

Which type of process is described below?
The Station A stamping machine receives 250 Kg of rolled stock from Roller Station B, which it stamps into bearings.

An attacker crafts an email that will send a user to the following site if they click a link in the message.

What else is necessary for this type of attack to work? hmi.giac.org/disconnect?sensor=812

Which resource includes a standardized categorization of common software vulnerabilities?

From the GIAC directory on the Desktop, open gicsp.pcap in Wireshark and filter for USB Capture data.
Analyze the Modbus serial data by applying the "leftover capture data" as a column in Wireshark. In packet 28, what read function is requested? Use the protocol description in the image.

Which type of process is used to manufacture fuels, chemicals, and plastics?

Which of the following is located in user mode of a typical real-time OS, but in kernel mode of a typical standard OS?

Use sqlmap to dump tables from http://localhost/index.php? page-login.php. The data necessary for this is as follows:

user_name=j password=p Submit_button=Submit - How many tables does sqlmap find in the dojo_control database? Hint: The option to dump tables is --tables