Exam GICSP Topic 1 Question 42 Discussion
Actual exam question for GIAC's GICSP exam
Question #: 42
Topic #: 1
Question #: 42
Topic #: 1
A plant is being retrofitted with new cyber security devices in Purdue Level 3. What should the network security architect suggest for the installation?
Suggested Answer: B Vote an answer
Comprehensive and Detailed Explanation From Exact Extract:
In Purdue Level 3, which typically houses operations management systems and network devices, best practices for retrofitting security devices include placing those devices on their own subnet (B). This segmentation:
Limits broadcast domains and reduces unnecessary traffic
Enables easier management of security policies specific to cybersecurity devices Provides isolation that helps protect security devices from general network traffic and potential attacks Adding a firewall (A) is useful but does not replace subnet segregation. Moving devices to a DMZ (C) is typically reserved for systems that bridge between enterprise and ICS networks (often at Purdue Level 3 to Level 4 boundaries), not internal device placement within Level 3.
This approach is emphasized in GICSP's ICS Security Architecture & Network Segmentation domain as a fundamental network design principle.
Reference:
GICSP Official Study Guide, Domain: ICS Security Architecture & Design
NIST SP 800-82 Rev 2, Section 5.5 (Network Segmentation and Security Devices) GICSP Training on Network Security Architecture
In Purdue Level 3, which typically houses operations management systems and network devices, best practices for retrofitting security devices include placing those devices on their own subnet (B). This segmentation:
Limits broadcast domains and reduces unnecessary traffic
Enables easier management of security policies specific to cybersecurity devices Provides isolation that helps protect security devices from general network traffic and potential attacks Adding a firewall (A) is useful but does not replace subnet segregation. Moving devices to a DMZ (C) is typically reserved for systems that bridge between enterprise and ICS networks (often at Purdue Level 3 to Level 4 boundaries), not internal device placement within Level 3.
This approach is emphasized in GICSP's ICS Security Architecture & Network Segmentation domain as a fundamental network design principle.
Reference:
GICSP Official Study Guide, Domain: ICS Security Architecture & Design
NIST SP 800-82 Rev 2, Section 5.5 (Network Segmentation and Security Devices) GICSP Training on Network Security Architecture
by Kim at Oct 08, 2025, 05:14 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).