Active Defense in an ICS Environment GRID Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A water treatment facility wants to deploy a honeypot that appears as a PLC controlling a chlorine dosing skid. The ICS network uses Modbus/TCP and the security team wants to detect reconnaissance without risking interaction with the real process. Which deployment approach best meets these requirements?

   • ADeploy a honeypot on the IT network that emulates a generic SCADA server, and configure the firewall to redirect all Modbus traffic from the DMZ to it for analysis.
   • BPlace a virtual honeypot on the same VLAN as the real PLCs, configured to respond to Modbus function codes with realistic register values, and log all connection attempts.
   • CUse a commercial honeypot appliance that automatically learns the real PLC's register map and then blocks any source that queries more than five registers in one minute.
   • DInstall a physical spare PLC in the control room, program it with the same logic as the chlorine skid, and connect it to the live process network so it can take over if the real PLC fails.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key architectural feature of a honeynet designed for ICS environments?

   • AA controlled gateway that monitors and limits inbound and outbound traffic.
   • BHoneypots are configured with the same credentials as production systems.
   • CThe honeynet is directly connected to the internet without any firewall.
   • DAll honeypots are placed on the same subnet as production PLCs.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security manager wants to explain the difference between active and passive defense to the board of directors. The company has already implemented network segmentation, firewalls, and an IDS. The manager wants to propose additional measures that actively engage with potential attackers. Which measure best exemplifies active defense?

   • AUpgrading the firewall to a next-generation firewall with application-level inspection.
   • BIncreasing the logging verbosity on all network devices to capture more data.
   • CDeploying a honeypot that emulates a PLC and monitoring for any interaction with it.
   • DConducting regular vulnerability scans of the OT network to identify weaknesses.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A manufacturing company suspects an attacker has gained access to its OT network and is moving laterally toward the PLC programming workstations. The security team wants to deploy honeytokens to detect this movement without disrupting production. Which honeytoken implementation is most appropriate for this scenario?

   • AAdd a fake user account with administrative privileges to the domain and monitor for login attempts using that account.
   • BDeploy a network-based IDS rule that alerts on any Modbus traffic to the engineering workstation's IP address.
   • CCreate a honeytoken that is a valid set of credentials for the actual engineering workstation and monitor for its use.
   • DPlace a file named 'PLC_Backup_Config.zip' on a file share that only the engineering team uses, and monitor for any access to that file.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A manufacturing company wants to implement a cyber deception plan to detect attackers who have already breached the IT network and are attempting to pivot into the OT network. The OT network uses a mix of legacy and modern PLCs, and any disruption to production is unacceptable. Which deception plan design best balances detection value with operational safety?

   • ACreate a fake engineering workstation on the IT network that has a mapped drive to the OT network's file server, and monitor for any access to that drive.
   • BUse a commercial deception platform that automatically deploys decoys on every subnet in the OT network and then automatically blocks any source that interacts with a decoy.
   • CDeploy a honeynet that mirrors the OT network's IP addressing scheme, with fake HMIs and PLCs that emulate common protocols, and place it on a separate VLAN that is only reachable from the IT-OT boundary.
   • DPlace honeypots directly on the production OT network, configured to respond to the same protocols as the real PLCs, so that attackers scanning the network will find them.
   Reveal Solution Discussion Select an answer first