A power utility's security team wants to detect lateral movement from the IT network into the ICS DMZ. They have read-only access to the DMZ's Active Directory and can create new accounts. Which honeytoken implementation would best detect an attacker using stolen credentials to access the DMZ?

Create a honeypot user account in the DMZ's Active Directory and configure it to automatically reset its password every 15 minutes.

Add a fake data point to the historian database that shows an abnormal turbine temperature, and monitor the SCADA alarm log for an operator acknowledging it.

Place a file named 'passwords.txt' on a file share in the DMZ that contains the real administrator password, and monitor for file access.

Create a fake service account named 'svc_historian' with a strong password, place it in a group that has read access to a decoy file share, and monitor for any authentication attempts with that account.

GIAC Response and Industrial Defense

Domain 1Objective 1

Active Defense in an ICS Environment GRID Practice Questions (Page 7)

Part of the ICS Security Operations domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 7–11 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

Questions 31–32

31application · medium
A power utility's security team wants to detect lateral movement from the IT network into the ICS DMZ. They have read-only access to the DMZ's Active Directory and can create new accounts. Which honeytoken implementation would best detect an attacker using stolen credentials to access the DMZ?
Select an answer first
32foundation · easy
Which deception technology consists of a network of multiple honeypots designed to capture extensive attacker activity?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.

Active Defense in an ICS Environment GRID Practice Questions (Page 7)

Questions 31–32

A power utility's security team wants to detect lateral movement from the IT network into the ICS DMZ. They have read-only access to the DMZ's Active Directory and can create new accounts. Which honeytoken implementation would best detect an attacker using stolen credentials to access the DMZ?

Which deception technology consists of a network of multiple honeypots designed to capture extensive attacker activity?

Keep studying — ICS Security Operations