Detection in an ICS Environment GRID Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A chemical plant has never performed a formal ICS asset inventory. The security team is deploying an active scanner to enumerate devices on the control network. The network contains legacy PLCs that are known to crash when scanned aggressively, a modern DCS with redundant controllers, and several unmanaged Ethernet switches. The team needs a complete asset list to build detection use cases. Which approach best balances safety and completeness?

   • ADisable all switch ports during the scan to prevent any device from being disrupted by network traffic.
   • BRun a full TCP connect scan on all ports with default timing to ensure every device is identified quickly.
   • CUse passive network monitoring to observe traffic and build an asset list, then supplement with active scans only on devices that do not respond passively and are known to tolerate scanning.
   • DScan only the modern DCS controllers because they are the most critical assets and the legacy PLCs are not important.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key characteristic of passive network monitors used in ICS security monitoring?

   • AThey replace the need for a SIEM
   • BThey observe network traffic without injecting packets or affecting the ICS network
   • CThey actively scan all devices to identify vulnerabilities
   • DThey block malicious traffic in real time
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a specialized tool or platform commonly used for ICS security monitoring?

   • AA SIEM that integrates ICS protocol parsers and asset inventory data
   • BA database management system
   • CA standard office productivity suite
   • DA web browser
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A nuclear power plant's security team is reviewing SIEM alerts. They see a series of Modbus writes to a turbine governor's setpoint registers from an engineering workstation. The writes are incrementing the setpoint by small amounts over several hours. The workstation is used by a contractor who is on site for a scheduled maintenance. The contractor's badge logs show they were in the control room during the writes. The plant's change management system has no record of these writes. What is the most likely scenario?

   • AThe contractor's workstation is compromised, and an attacker is using it to slowly manipulate the turbine governor setpoints.
   • BThe SIEM is generating false positives because the contractor's workstation is trusted.
   • CThe contractor is following a verbal instruction from the plant manager to adjust the setpoints.
   • DThe contractor is performing an unauthorized but benign adjustment to the turbine governor.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst at a power utility is reviewing alerts from the SIEM. The SIEM flagged a series of Modbus TCP writes to a protective relay's setpoint registers from an engineering workstation. The writes occurred at 3:00 AM, and the workstation is not normally used at that time. The analyst also sees a separate alert for a failed login to the same workstation at 2:55 AM. Which of the following is the most appropriate next step in the incident detection workflow?

   • AEscalate the combined alerts to the incident response team as a potential coordinated attack, preserving the logs and the workstation's state.
   • BChange the relay's setpoint back to its original value and continue monitoring.
   • CClose both alerts as false positives because the workstation is on the trusted engineering network.
   • DReboot the workstation to clear any malware and then re-run the Modbus writes to see if they still occur.
   Reveal Solution Discussion Select an answer first