Exam GICSP Topic 1 Question 70 Discussion
Actual exam question for GIAC's GICSP exam
Question #: 70
Topic #: 1
Question #: 70
Topic #: 1
What is the purpose of the traffic shown in the screenshot?
Suggested Answer: A Vote an answer
The Wireshark capture filter is set to modbus_tcp.func_code == 5. According to the Modbus protocol specification:
Function code 5 corresponds to Write Single Coil (A).
Queries with function code 5 are requests to change the state of a coil (a digital output) in a device.
The packet details confirm "function 5: Write coil" with the reference number and data.
Other function codes (such as read coils or read registers) use different function codes, so options C and E are incorrect. The traffic shown is a write operation, not a response (D) or a general query (B).
Reference:
GICSP Official Study Guide, Domain: ICS Security Operations & Incident Response Modbus Application Protocol Specification GICSP Training on ICS Network Traffic Analysis
Function code 5 corresponds to Write Single Coil (A).
Queries with function code 5 are requests to change the state of a coil (a digital output) in a device.
The packet details confirm "function 5: Write coil" with the reference number and data.
Other function codes (such as read coils or read registers) use different function codes, so options C and E are incorrect. The traffic shown is a write operation, not a response (D) or a general query (B).
Reference:
GICSP Official Study Guide, Domain: ICS Security Operations & Incident Response Modbus Application Protocol Specification GICSP Training on ICS Network Traffic Analysis
by Sandy at Jan 18, 2026, 09:01 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).