Active Defense in an ICS Environment GRID Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an example of a threat hunting activity in an ICS environment?

   • AAnalyzing network traffic for unusual Modbus function codes.
   • BWaiting for an IDS alert before investigating.
   • CPerforming routine backups of PLC configurations.
   • DUpdating antivirus signatures on engineering workstations.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is an ethical concern when using deception technologies in an ICS environment?

   • ADeception technologies are only ethical in IT environments, not ICS.
   • BDeception technologies are unethical because they waste resources.
   • CDeception technologies are always unethical and should never be used.
   • DDeception could inadvertently affect legitimate users or systems if not properly isolated.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is an example of a honeytoken?

   • AA fake user account with a password that is never used by legitimate personnel.
   • BA network firewall rule that blocks all inbound traffic.
   • CA real administrator password stored in a secure vault.
   • DA backup of the production database stored offsite.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an active response technique that could be used in an ICS environment?

   • AInstalling security patches during scheduled maintenance.
   • BBlocking the source IP address of a malicious session.
   • CReviewing firewall logs after an incident.
   • DPassively monitoring network traffic with a SPAN port.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an example of a passive defense strategy in an ICS environment?

   • ADeploying a honeypot that emulates a PLC to lure attackers.
   • BActively terminating malicious sessions detected on the ICS network.
   • CFeeding fake process data to an attacker who has breached the ICS network.
   • DImplementing network segmentation and access control lists to limit unauthorized access.
   Reveal Solution Discussion Select an answer first