Active Defense in an ICS Environment GRID Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the main purpose of placing a honeytoken in an ICS network?

   • ATo improve the performance of the ICS network.
   • BTo provide a backup for critical process data.
   • CTo detect unauthorized access or lateral movement by monitoring when the token is used.
   • DTo replace the need for user authentication.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary goal of threat hunting in an ICS network?

   • ATo replace the need for intrusion detection systems.
   • BTo ensure compliance with regulatory standards.
   • CTo proactively search for indicators of compromise that may have evaded existing security controls.
   • DTo automatically patch vulnerabilities in ICS devices.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A chemical plant wants to implement a cyber deception plan to detect attackers who might target its distributed control system (DCS). The plant has strict safety requirements and limited staff to manage the deception infrastructure. The plan must include honeypots, honeytokens, and active response capabilities. Which design approach best meets these requirements?

   • ADeploy honeytokens only, without any honeypots, and rely on the existing security monitoring to detect when the tokens are accessed.
   • BUse a combination of low-interaction honeypots for common ICS protocols, place honeytokens in engineering file shares, and configure automated blocking rules that only affect the decoy network.
   • CDeploy a single high-interaction honeypot that emulates the DCS and integrate it with the existing SIEM, but do not implement active response to avoid any risk.
   • DCreate a fully virtualized replica of the entire production network, including all PLCs and HMIs, and use it as a honeynet with no restrictions on outbound traffic.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst wants to deploy honeytokens to detect an attacker who is attempting to access the engineering workstation that is used to program PLCs. The analyst has access to the file server and can create files. Which honeytoken would be most effective and safe?

   • ACreate a fake user account named 'admin_backup' with a weak password and monitor for login attempts.
   • BPlace a honeytoken in the form of a database entry that contains the IP address of the engineering workstation.
   • CCreate a file named 'PLC_Program_Backup.zip' on the file server and monitor for any read access to that file.
   • DDeploy a honeypot that emulates the engineering workstation and monitor for any connection attempts.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A water utility wants to deploy a honeypot that emulates a PLC on its OT network to detect reconnaissance. The OT network uses Modbus/TCP and the security team wants the honeypot to be reachable from the IT network to lure attackers. The safety team is concerned about accidental interference with the live process. Which deployment approach best balances detection value and safety?

   • AInstall the honeypot directly on the same switch segment as the live PLCs so it sees the same broadcast traffic and appears more realistic.
   • BConfigure the honeypot to respond to all Modbus function codes exactly like a real PLC, including write commands that could affect the emulated process.
   • CDeploy the honeypot on a dedicated VLAN with a firewall rule allowing inbound Modbus/TCP from the IT network, and ensure the honeypot has no route to the live PLCs.
   • DPlace the honeypot on the IT network only, with no connection to the OT network, and monitor for scans from external IPs.
   Reveal Solution Discussion Select an answer first