Exam GICSP Topic 1 Question 49 Discussion

Actual exam question for GIAC's GICSP exam
Question #: 49
Topic #: 1
An organization has their ICS operations and networking equipment installed in the Purdue model level 3.
Where should the SIEM for this equipment be placed in relation to the existing Level 3 devices?

Suggested Answer: B Vote an answer

According to the Purdue model and best practices outlined in GICSP, Level 4 corresponds to the enterprise or business network, often containing management and security monitoring infrastructure such as Security Information and Event Management (SIEM) systems.
Placing the SIEM on a management subnet in Level 4 (B) keeps monitoring tools separated from the operational control network (Level 3), reducing the risk that a compromised Level 3 device could affect the security infrastructure itself. It also allows the SIEM to collect logs from multiple network segments securely and apply enterprise-wide analysis.
This segregation supports defense-in-depth and aligns with GICSP's emphasis on secure network segmentation and monitoring.
Reference:
GICSP Official Study Guide, Domain: ICS Security Architecture & Design
NIST SP 800-82 Rev 2, Section 5.5 (Network Architecture)
GICSP Training Materials on Network Segmentation and SIEM Deployment

by Celeste at Oct 30, 2025, 01:01 PM

Limited Time Offer

15%

Off

Get Premium GICSP Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10