GIAC GICSP : Global Industrial Cyber Security Professional (GICSP)

You are responsible for developing a disaster recovery plan for a critical ICS facility. Which of the following actions should you include to ensure a risk-based approach to disaster recovery?
(Select all that apply)
Response:

• A. Focus solely on cost-saving measures
• B. Identify and prioritize recovery of critical systems
• C. Establish a clear chain of command for incident response
• D. Implement regular disaster recovery drills and exercises

Which of the following is a common method used to harden Unix-based endpoints in ICS environments?
Response:

• A. Allowing root access by default
• B. Disabling unnecessary services
• C. Installing additional software packages
• D. Increasing file system size

How can logging be utilized to enhance endpoint protection in an ICS environment?
Response:

• A. By providing a record of events for monitoring and auditing
• B. By increasing processing power for critical applications
• C. By automatically resolving security incidents
• D. By reducing system resource usage

Which of the following is a key security concern when designing Level 3 of the Purdue Reference Architecture in an ICS?
Response:

• A. Managing physical access to the control room
• B. Ensuring real-time process control
• C. Increasing network throughput
• D. Protecting the interface between the ICS network and the business network

Which of the following should be included in an ICS incident response policy?
Response:

• A. Guidelines for upgrading network hardware
• B. Procedures for handling security breaches
• C. Instructions for setting up user accounts
• D. Steps to disable network encryption