The second time you see a question, you are often recalling the answer rather than reasoning to it. That is the single biggest weakness of practicing on one question bank, and it is why scores on a re-sit look better than exam day does.

This is Volume 2. Five more timed practice tests, 430 new questions, nothing carried over from Volume 1.

Same scope, same difficulty, different questions

Coverage follows the same seven GRID objectives at the same weighting, so your score here is directly comparable to your Volume 1 score. If your Volume 1 result was real understanding, it holds. If it was memory, this set will say so quickly.

Every question is single-best-answer, matching GIAC's format, and every question is followed by an explanation that names the reasoning, the failed distractor and the objective area to revisit.

What the questions cover

• Active defense as GIAC defines it, and what the major ICS incidents changed about defensive posture

• Detection and analysis of network security evidence inside an industrial environment

• Asset awareness and visibility where active scanning is restricted or forbidden

• Monitoring against real protocol behavior: Modbus function codes, DNP3, OPC UA security modes, S7 COTP parameters, IEC 104 and EtherNet/IP CIP services

• Incident response and forensics on controllers, engineering workstations and historians, with safety and uptime as hard constraints

• Threat hunting, hypothesis building and malware analysis applied to OT tooling

• Threat intelligence, from consuming a report to shipping a detection

How to work through it

Take one test per study session under real time pressure. Score it, then read every explanation, including on the questions you answered correctly, because a correct guess and a correct answer look identical on a score report and nowhere else. Track which of the seven objectives your misses cluster in. Study that objective, then move to the next test.

Across both volumes that gives you ten full timed sittings and 860 questions, which is enough repetition that exam format, pacing and question phrasing stop costing you points and the only thing being tested is what you actually know.

Please note: this is an independently produced preparation course. It is not affiliated with, authorized by, endorsed by or sponsored by GIAC or the SANS Institute. All questions are original study material, not actual exam items. Confirm the current number of questions, time limit, passing score and permitted materials for your specific attempt in your own GIAC account before exam day.