A security team wants to build a honeynet to study attacker behavior targeting their ICS environment. They have a limited budget and need to capture detailed attack techniques without risking the production network. Which honeynet architecture is most appropriate?

A single honeypot that only logs connection attempts and does not respond to any protocol requests.

A network of multiple low-interaction honeypots that emulate different ICS protocols and are placed on a separate VLAN with strict egress filtering.

A single high-interaction honeypot that fully emulates a PLC and allows attackers to interact with a real operating system.

A virtualized environment that replicates the entire production ICS network, including real PLCs and HMIs, with no network segmentation.

When deploying a honeypot that mimics an ICS protocol, which of the following is essential to make it convincing to an attacker?

Ensuring the honeypot has the same IP address as a real PLC.

Accurately emulating the protocol's expected responses and device behavior.

Using the latest encryption algorithms for all communications.

Connecting the honeypot directly to the live production network without isolation.

What is the primary purpose of a honeypot in an ICS environment?

To provide a backup system for critical ICS processes.

To replace the need for traditional security controls like firewalls and IDS.

To lure attackers into a decoy system so their activities can be monitored and analyzed.

To automatically patch vulnerabilities in real ICS devices.

What is the primary benefit of using a honeynet to study attacker behavior in an ICS context?

It automatically patches vulnerabilities in real ICS devices.

It replaces the need for network monitoring tools like IDS.

It provides a safe environment to observe how attackers interact with simulated ICS devices.

It ensures that attackers are immediately arrested.

How can active defense measures be integrated into ICS operations with minimal disruption?

By deploying them in a segregated network segment that mirrors the production environment.

By disabling all alarms during the deployment.

By using only passive measures that do not interact with the network.

By deploying them directly on the same switches as safety systems.

GIAC Response and Industrial Defense

Domain 1Objective 1

Active Defense in an ICS Environment GRID Practice Questions (Page 4)

Part of the ICS Security Operations domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 7–11 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

Questions 16–20

16application · medium
A security team wants to build a honeynet to study attacker behavior targeting their ICS environment. They have a limited budget and need to capture detailed attack techniques without risking the production network. Which honeynet architecture is most appropriate?
Select an answer first
17foundation · easy
When deploying a honeypot that mimics an ICS protocol, which of the following is essential to make it convincing to an attacker?
Select an answer first
18foundation · easy
What is the primary purpose of a honeypot in an ICS environment?
Select an answer first
19foundation · easy
What is the primary benefit of using a honeynet to study attacker behavior in an ICS context?
Select an answer first
20foundation · easy
How can active defense measures be integrated into ICS operations with minimal disruption?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.