Active Defense in an ICS Environment GRID Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In the context of ICS security, what is the primary distinction between active defense and passive defense?

   • AActive defense involves directly engaging or manipulating adversaries, while passive defense relies on protective measures that do not interact with the attacker.
   • BActive defense is only used in IT networks, while passive defense is used exclusively in ICS environments.
   • CActive defense is always automated, while passive defense is always manual.
   • DActive defense requires physical security controls, while passive defense uses only logical controls.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is safety a critical consideration when applying active response techniques in an ICS environment?

   • ABecause active responses are only used in IT networks, not ICS.
   • BBecause active responses require more computing power than passive measures.
   • CBecause active responses are always illegal in ICS environments.
   • DBecause active responses might inadvertently disrupt critical processes, causing unsafe conditions.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security consultant is advising a power utility on the legal and ethical implications of using active defense techniques, including honeypots and active response. The utility operates critical infrastructure and is subject to regulatory oversight. Which consideration is most important when recommending active defense measures?

   • AUse honeypots that are indistinguishable from real systems and do not disclose their nature to anyone, including law enforcement.
   • BFocus only on passive defense measures because any active defense technique is illegal in critical infrastructure environments.
   • CEnsure that any active response action, such as blocking or terminating sessions, is documented and approved by legal counsel to avoid liability.
   • DDeploy active response measures that automatically terminate any suspicious session without human review to minimize the window of exposure.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Why is it important to monitor a honeypot that emulates ICS devices?

   • ATo ensure the honeypot is not accidentally accessed by legitimate operators.
   • BTo capture and analyze attacker interactions for threat intelligence.
   • CTo ensure the honeypot does not consume too much CPU.
   • DTo verify that the honeypot is compatible with the latest Windows updates.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the first step in designing a cyber deception plan for an ICS environment?

   • ADisabling all security monitoring to avoid false positives.
   • BIdentifying critical assets and understanding the threat model.
   • CPurchasing commercial honeypot appliances.
   • DDeploying honeypots on all network segments immediately.
   Reveal Solution Discussion Select an answer first