SANS GICSP EXAM QUESTIONS WITH
CORRECT SOLUTIONS||100%
GUARANTEED PASS||UPDATED
2026/2027 SYLLABUS||ALREADY
GRADED A+||<<NEWEST
VERSION>>
WirelessHART (IEC 62591) - Security enabled wireless version of HART -
ANSWER ✓ - Multi-vendor wireless standard (2007)
- Designed for process field device networks
- Wireless Industrial Technology Konsortium (WiTECK) (37 members)
- 50-80% market share in wireless ICS
IEC 62591 - ANSWER ✓ WirelessHART
HART - ANSWER ✓ - Highway Addressable Remote Transducer Protocol
- Serial-based like Modbus used over 4-20ma analog circuits
WirelessHART Technical Details - ANSWER ✓ - 2.4GHz ISM Band (Same as
Wi-Fi but NOT Wi Fi)
- Leverages IEEE 802.15.4 for PHY/MAC (Same as Zigbee)
- Mesh network for "self-healing"
- Channel hopping to allow to work in same area as 2.4GHz protocols
Wireless HART Security - ANSWER ✓ - Can be configured with unique join
keys for each device
- Join key configured manually on field device maintenance port (wirelessly)
- Successful encrypted join packet retrieves network key
- Join can be restricted by key, manufacturer, and product name/tag
- All payloads encrypted with unique session key per device
- Rogue devices cannot spoof other devices because of unique keys
- Cryptographic-based nonrepudiation to verify data came from the device
, ISA100.11a (IEC 62734) - ANSWER ✓ - Wireless Standard developed by ISA
- Competes with WirelessHART
- Uses 6LoWPAN to gain benefits of IPv6
- Used 802.15.4 and Direct Sequence Spread Spectrum (DSSS) for PHY layer
- Uses Time Division Multiple Access (TDMA) and meshing topology for MAC
layer
- Removed requirement for secuirty keys
- Offers support for asymmetric join methods and Over the Air device
configuration
Bluetooth (1998) - ANSWER ✓ - No line of sight requirement
- Supports data, voice, content-centric applications with Bluetooth Profiles
- Up to 7 simultaneous connections
Bluetooth Security - ANSWER ✓ - Authentication stars with user selecting PIN
to authenticate other devices in the Bluetooth PICONET
- BD_ADDR (Pronounce Bee Dee Adder) (MAC Address)
- PIN+MAC = Security Keys
- Some devices use fixed PINs
- Sniffing risk when first pair
(Day 4, Page 136)
Zigbee - ANSWER ✓ - 802.15.4
- Low cost cable replacement technology
- Close to 100M nodes in 2012
- Honeywell = HVAC systems
- Zigbee used for low power consumption and rely on long, multi-year battery life
Zigbee Security - ANSWER ✓ - Accomodate security at MAC(2), Network (3)
and Application (7) Layers
- Relies on master keys set by mfg, installer or end-user - Generates link keys to
encrypt traffic
- Encryption Based on AES-CCM (128 bit block cipher)
- Security optional - AES may be too resource intensive for lightweight devices
(battery life vs security)
- KillerBee = python-based framework by Joshua Wright for Zigbee and other
802.15.4 devices
802.11x WiFi (1997) - ANSWER ✓ - 802.11b = 11 Mbps@2.4GHz
,- 802.11a = 54 Mbps@ 5 GHz
- 802.11g = 22/54 Mbps @ 2.4 GHz
- 802.11n = 100+ Mbps @ 5 GHz
- Large data packets supported through fragmentation at Layer 2
802.11i - ANSWER ✓ - Provides strong encryption, replay protection, integrity
protection
Extensible Authentication Protocol (EAP) - ANSWER ✓ - Authentication
support for wireless
- Different EAP types suitable for different environments -- considering clients,
directory type, hardware
WiFi - WEP Security Issues - ANSWER ✓ = wired equivalent privacy
- Based on pre-shared secret common to all stations in same wireless network
- Spec never included rotation of shared secret
- Not easy to change shared secrets
- Recover WEP key after collecting millions of packets
- Tools used: WEPCrack, AirSnort, dwepcrack (Written for Linux or BSD
systems)
- New fast tools: wnet/reinj, WEPWedgie (<1hour)
WiFi Protected Access (WPA) (2003) - ANSWER ✓ - WiFi Alliance =
interoperability testing for 802.11 h/w vendors, consumers
- Uses TKIP (Temporal Key Integrity Protocol)
- WPA2 (Preferred) - Vast improvement over WEP, requires Access Point and NIC
replacement (AES-CCMP)
WiFi Networks - protecting - ANSWER ✓ - Migrate from WEP > WPA > WPA2
- Use Strong Authentication mechanism like PEAP (Protected Extensible
Authentication Protocol) or TTLS (Tunnelled Transport Layer Security)
- Mutual authentication to mitigate MITM and masquerading attacks
- Always require mutual authentication
- Audit network installations for consistency in deployment and config
- Delete default admin passwords, community strings, or HTTP-enabled config
pages
- Educate users on how to spot suspect activity on WiFi network
, WiFi - Top Security Risks for All Wireless Protocols and Standards - ANSWER
✓ - Eavesdropping
- Masquerading
- DoS
- Rogue APs
Wireless Eavesdropping - ANSWER ✓ - Signal can be picked up for >300 feet
- Use antennas (Pringles chip can) -- extend from 600 feet to several miles
Wireless Eavesdropping Mitigation - ANSWER ✓ - Use strong encryption and
authentication in lowest layer of protocol possible (at PHY/MAC if avail)
- Use TKIP for WPA - prefer to use WPA2 (AES)
- Encrypt at multiple layers - low and high
- Design wireless network with minimal coverage area
- Audit network with packet sniffer (Kismet, Wireshark)
Wireless Masquerading - ANSWER ✓ - Impersonate an authorized client or
access point
- Uses "Evil Twin" attack
- Attacker changes MAC address
WiFi Masquerade Mitigation - ANSWER ✓ - use 802.1x (not very practical)
- Use mutual authentication protocols like PEAP (Protected Extensible
Authentication Protocol) or TTLS (Tunnelled Transport Layer Security)
- Use SSL/TLS for passing sensitive info to web apps (e.g., HTTPS)
- Educate users on dangers of clicking YES to digital certificate warnings
- Attack tool = AirSnarf
Wireless DoS Attacks - ANSWER ✓ - RF jamming techniqes/tools
- Wireless technologies NOT using frequency hopping less susceptible -- but not
impervious
-- e.g., Bluetooth based on frequency hopping/spread spectrum
- 802.11 spec does not include per packet authentication mechanism
- Flaws in wi-fi card firmware
WiFi - Wireless DoS Attack Mitigation - ANSWER ✓ - Understand impact of a
DoS attack against environment
- Prepare response strategy - especially for attack against production network
- Wireless IDS possible but not widely avail
CORRECT SOLUTIONS||100%
GUARANTEED PASS||UPDATED
2026/2027 SYLLABUS||ALREADY
GRADED A+||<<NEWEST
VERSION>>
WirelessHART (IEC 62591) - Security enabled wireless version of HART -
ANSWER ✓ - Multi-vendor wireless standard (2007)
- Designed for process field device networks
- Wireless Industrial Technology Konsortium (WiTECK) (37 members)
- 50-80% market share in wireless ICS
IEC 62591 - ANSWER ✓ WirelessHART
HART - ANSWER ✓ - Highway Addressable Remote Transducer Protocol
- Serial-based like Modbus used over 4-20ma analog circuits
WirelessHART Technical Details - ANSWER ✓ - 2.4GHz ISM Band (Same as
Wi-Fi but NOT Wi Fi)
- Leverages IEEE 802.15.4 for PHY/MAC (Same as Zigbee)
- Mesh network for "self-healing"
- Channel hopping to allow to work in same area as 2.4GHz protocols
Wireless HART Security - ANSWER ✓ - Can be configured with unique join
keys for each device
- Join key configured manually on field device maintenance port (wirelessly)
- Successful encrypted join packet retrieves network key
- Join can be restricted by key, manufacturer, and product name/tag
- All payloads encrypted with unique session key per device
- Rogue devices cannot spoof other devices because of unique keys
- Cryptographic-based nonrepudiation to verify data came from the device
, ISA100.11a (IEC 62734) - ANSWER ✓ - Wireless Standard developed by ISA
- Competes with WirelessHART
- Uses 6LoWPAN to gain benefits of IPv6
- Used 802.15.4 and Direct Sequence Spread Spectrum (DSSS) for PHY layer
- Uses Time Division Multiple Access (TDMA) and meshing topology for MAC
layer
- Removed requirement for secuirty keys
- Offers support for asymmetric join methods and Over the Air device
configuration
Bluetooth (1998) - ANSWER ✓ - No line of sight requirement
- Supports data, voice, content-centric applications with Bluetooth Profiles
- Up to 7 simultaneous connections
Bluetooth Security - ANSWER ✓ - Authentication stars with user selecting PIN
to authenticate other devices in the Bluetooth PICONET
- BD_ADDR (Pronounce Bee Dee Adder) (MAC Address)
- PIN+MAC = Security Keys
- Some devices use fixed PINs
- Sniffing risk when first pair
(Day 4, Page 136)
Zigbee - ANSWER ✓ - 802.15.4
- Low cost cable replacement technology
- Close to 100M nodes in 2012
- Honeywell = HVAC systems
- Zigbee used for low power consumption and rely on long, multi-year battery life
Zigbee Security - ANSWER ✓ - Accomodate security at MAC(2), Network (3)
and Application (7) Layers
- Relies on master keys set by mfg, installer or end-user - Generates link keys to
encrypt traffic
- Encryption Based on AES-CCM (128 bit block cipher)
- Security optional - AES may be too resource intensive for lightweight devices
(battery life vs security)
- KillerBee = python-based framework by Joshua Wright for Zigbee and other
802.15.4 devices
802.11x WiFi (1997) - ANSWER ✓ - 802.11b = 11 Mbps@2.4GHz
,- 802.11a = 54 Mbps@ 5 GHz
- 802.11g = 22/54 Mbps @ 2.4 GHz
- 802.11n = 100+ Mbps @ 5 GHz
- Large data packets supported through fragmentation at Layer 2
802.11i - ANSWER ✓ - Provides strong encryption, replay protection, integrity
protection
Extensible Authentication Protocol (EAP) - ANSWER ✓ - Authentication
support for wireless
- Different EAP types suitable for different environments -- considering clients,
directory type, hardware
WiFi - WEP Security Issues - ANSWER ✓ = wired equivalent privacy
- Based on pre-shared secret common to all stations in same wireless network
- Spec never included rotation of shared secret
- Not easy to change shared secrets
- Recover WEP key after collecting millions of packets
- Tools used: WEPCrack, AirSnort, dwepcrack (Written for Linux or BSD
systems)
- New fast tools: wnet/reinj, WEPWedgie (<1hour)
WiFi Protected Access (WPA) (2003) - ANSWER ✓ - WiFi Alliance =
interoperability testing for 802.11 h/w vendors, consumers
- Uses TKIP (Temporal Key Integrity Protocol)
- WPA2 (Preferred) - Vast improvement over WEP, requires Access Point and NIC
replacement (AES-CCMP)
WiFi Networks - protecting - ANSWER ✓ - Migrate from WEP > WPA > WPA2
- Use Strong Authentication mechanism like PEAP (Protected Extensible
Authentication Protocol) or TTLS (Tunnelled Transport Layer Security)
- Mutual authentication to mitigate MITM and masquerading attacks
- Always require mutual authentication
- Audit network installations for consistency in deployment and config
- Delete default admin passwords, community strings, or HTTP-enabled config
pages
- Educate users on how to spot suspect activity on WiFi network
, WiFi - Top Security Risks for All Wireless Protocols and Standards - ANSWER
✓ - Eavesdropping
- Masquerading
- DoS
- Rogue APs
Wireless Eavesdropping - ANSWER ✓ - Signal can be picked up for >300 feet
- Use antennas (Pringles chip can) -- extend from 600 feet to several miles
Wireless Eavesdropping Mitigation - ANSWER ✓ - Use strong encryption and
authentication in lowest layer of protocol possible (at PHY/MAC if avail)
- Use TKIP for WPA - prefer to use WPA2 (AES)
- Encrypt at multiple layers - low and high
- Design wireless network with minimal coverage area
- Audit network with packet sniffer (Kismet, Wireshark)
Wireless Masquerading - ANSWER ✓ - Impersonate an authorized client or
access point
- Uses "Evil Twin" attack
- Attacker changes MAC address
WiFi Masquerade Mitigation - ANSWER ✓ - use 802.1x (not very practical)
- Use mutual authentication protocols like PEAP (Protected Extensible
Authentication Protocol) or TTLS (Tunnelled Transport Layer Security)
- Use SSL/TLS for passing sensitive info to web apps (e.g., HTTPS)
- Educate users on dangers of clicking YES to digital certificate warnings
- Attack tool = AirSnarf
Wireless DoS Attacks - ANSWER ✓ - RF jamming techniqes/tools
- Wireless technologies NOT using frequency hopping less susceptible -- but not
impervious
-- e.g., Bluetooth based on frequency hopping/spread spectrum
- 802.11 spec does not include per packet authentication mechanism
- Flaws in wi-fi card firmware
WiFi - Wireless DoS Attack Mitigation - ANSWER ✓ - Understand impact of a
DoS attack against environment
- Prepare response strategy - especially for attack against production network
- Wireless IDS possible but not widely avail
