Detection in an ICS Environment GRID Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An ICS security analyst is tuning a detection rule for DNP3 traffic on a power utility network. The rule currently flags any DNP3 message with an unexpected function code. Over the past week, the rule generated 200 alerts, but only 5 were confirmed as genuine anomalies. The analyst reviews the traffic and finds that most false positives come from a specific substation RTU that occasionally sends function code 0x1F (unsolicited response) during normal operation. What is the best approach to reduce false positives while maintaining detection of genuine anomalies?

   • AAdd an exception for function code 0x1F from that specific RTU, but keep the rule active for all other devices and function codes.
   • BChange the rule to only alert on function codes that are not in the DNP3 specification.
   • CDisable the rule entirely to avoid alert fatigue.
   • DIncrease the alert threshold to require at least 10 occurrences of the same function code before alerting.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of developing ICS detection use cases?

   • ATo replace the need for security monitoring tools
   • BTo automatically remediate all detected threats
   • CTo eliminate all false positives from the monitoring system
   • DTo map specific detection rules to known ICS threats and operational scenarios
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common technique for reducing false positives in ICS detection?

   • ADisabling all detection rules
   • BIncreasing the sensitivity of all rules to catch more events
   • CWhitelisting known-good communication patterns, such as specific source-destination pairs
   • DIgnoring all alerts from the ICS network
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A food processing plant has a SIEM that collects logs from the PLCs, HMIs, and the historian. The security team is investigating a potential intrusion. They notice that the historian shows a 10-minute gap in data from a packaging line PLC at 2:00 PM. The HMI logs show that an operator logged in at 1:55 PM and ran a 'diagnostic' script. The PLC logs show no errors during that time. What is the most likely explanation?

   • AThe diagnostic script intentionally or unintentionally suppressed data reporting to the historian.
   • BThe PLC was rebooted by the diagnostic script, causing the historian to lose connection.
   • CThe network switch between the PLC and historian failed temporarily.
   • DThe historian's storage was full and it stopped recording data.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary goal of ICS log correlation and analysis?

   • ATo automatically patch vulnerabilities in ICS devices
   • BTo replace the need for network traffic analysis
   • CTo identify coordinated attacks or operational anomalies by correlating logs from multiple ICS components
   • DTo reduce the amount of log data stored by deleting older logs
   Reveal Solution Discussion Select an answer first