Active Defense in an ICS Environment GRID Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst at a natural gas pipeline company is tasked with proactively hunting for signs of an attacker who may have compromised a field RTU. The analyst has access to network flow logs, RTU event logs, and a threat intelligence feed of known malicious IPs. Which threat hunting approach would be most effective for this task?

   • ARun a vulnerability scanner against the RTU to identify any missing patches, and then apply the patches immediately.
   • BSearch the network flow logs for any connection from a known malicious IP to the RTU's IP address, and then review the RTU event logs for any corresponding commands.
   • CReview the RTU's configuration file to ensure that all default passwords have been changed, and document any that have not.
   • DMonitor the RTU's network traffic in real time for any packet that contains the string 'admin' or 'password'.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is conducting threat hunting in an ICS environment and wants to proactively search for indicators of compromise (IOCs) that might indicate an attacker is using legitimate engineering tools to interact with PLCs. Which threat hunting approach is most effective for this scenario?

   • ASearch for unusual Modbus function codes or read/write requests to PLCs that do not match the known maintenance schedule.
   • BReview firewall logs for any blocked inbound traffic from the internet.
   • CCheck for the presence of known malware signatures on all engineering workstations.
   • DLook for any connection from the IT network to the OT network, regardless of the source or destination.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team at a food processing plant discovers an attacker actively sending malicious commands to a PLC that controls a pasteurizer. The plant has a legal team that is concerned about liability. The team wants to take immediate action but is unsure about the legal and ethical boundaries of active defense. Which action is most defensible from a legal and ethical standpoint?

   • AShut down the pasteurizer to prevent the attacker from causing harm, and then investigate the incident.
   • BDeploy a honeypot that mimics the pasteurizer PLC and redirect the attacker to it, then monitor their actions to gather intelligence.
   • CBlock the attacker's IP address at the firewall and terminate the malicious session, while preserving all logs for potential legal action.
   • DLaunch a counterattack against the attacker's IP address to disable their command-and-control server.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why should a cyber deception plan be integrated into the overall ICS security strategy?

   • ATo ensure deception measures complement existing controls and do not create conflicts.
   • BTo comply with a mandatory industry standard.
   • CTo make the deception plan more expensive.
   • DTo hide the deception plan from security personnel.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A hospital's facilities management team wants to improve the security of its building automation system (BAS) without affecting the HVAC controls. They currently use only a firewall and antivirus on the BAS servers. Which additional measure would represent a shift from passive to active defense?

   • AInstall an antivirus agent on all BAS controllers to detect malware.
   • BUpdate the firewall rules to block all inbound traffic from the IT network to the BAS network.
   • CDeploy a honeypot that emulates a BACnet controller and place it on the BAS network to detect unauthorized scanning or access attempts.
   • DConduct a security awareness training for facilities staff to recognize phishing emails.
   Reveal Solution Discussion Select an answer first