An oil pipeline uses DNP3 over TCP for communication between a control center and remote terminal units (RTUs). The security team has a passive monitor that has been recording traffic for one month. The baseline shows that the control center polls each RTU every 2 seconds with function code 1 (Read) and occasionally sends function code 2 (Write) to update setpoints. The monitor alerts on a new pattern: an RTU is sending unsolicited responses with function code 0x81 (Response) containing an unexpected object type (0x3C, Analog Output Status) that has never appeared in the baseline. What does this anomaly most likely indicate?

A normal firmware update that changed the RTU's reporting behavior.

A false positive that should be ignored because DNP3 is a legacy protocol with many undocumented features.

A network misconfiguration that is causing the RTU to receive data meant for another device.

A potential malicious command injection or a fault in the RTU causing it to report data it was not configured to send.

A wastewater treatment plant has a historian that records all process values. The security team is implementing behavioral analytics to detect anomalies. The plant has seasonal variations in flow rates, with higher flows in the rainy season. The team has two years of historical data. They want to minimize false positives while detecting a cyber attack that manipulates process values. Which approach is most effective?

Create a single baseline for the entire year and alert on any deviation from it.

Set a fixed threshold for each process value based on the maximum value ever recorded.

Create separate baselines for each season and alert on deviations from the corresponding seasonal baseline.

Use a machine learning model that is trained on the last month of data only.

What is the goal of false positive reduction in ICS detection?

To increase the number of alerts generated by the system

To replace the monitoring system with a manual review process

To eliminate all alerts from the monitoring system

To minimize alerts that are not genuine threats while maintaining sensitivity to real attacks

In an ICS incident detection workflow, what is the purpose of triage?

To delete all logs related to the incident

To automatically patch the affected systems

To assess the severity and impact of a potential incident to determine the appropriate response

To immediately disconnect all ICS devices from the network

GIAC Response and Industrial Defense

Domain 1Objective 2

Detection in an ICS Environment GRID Practice Questions (Page 4)

Part of the ICS Security Operations domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 7–11 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

10concepts

Questions 16–20

16application · medium
An oil pipeline uses DNP3 over TCP for communication between a control center and remote terminal units (RTUs). The security team has a passive monitor that has been recording traffic for one month. The baseline shows that the control center polls each RTU every 2 seconds with function code 1 (Read) and occasionally sends function code 2 (Write) to update setpoints. The monitor alerts on a new pattern: an RTU is sending unsolicited responses with function code 0x81 (Response) containing an unexpected object type (0x3C, Analog Output Status) that has never appeared in the baseline. What does this anomaly most likely indicate?
Select an answer first
17expert · hard
A wastewater treatment plant has a historian that records all process values. The security team is implementing behavioral analytics to detect anomalies. The plant has seasonal variations in flow rates, with higher flows in the rainy season. The team has two years of historical data. They want to minimize false positives while detecting a cyber attack that manipulates process values. Which approach is most effective?
Select an answer first
18foundation · easy
What is the goal of false positive reduction in ICS detection?
Select an answer first
19foundation · easy
During a review of captured ICS network traffic, an analyst identifies a protocol that uses TCP port 502 and carries function codes such as 0x01 (Read Coils) and 0x05 (Write Single Coil). Which industrial protocol is the analyst observing?
Select an answer first
20foundation · easy
In an ICS incident detection workflow, what is the purpose of triage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.

Detection in an ICS Environment GRID Practice Questions (Page 4)

Questions 16–20

What is the goal of false positive reduction in ICS detection?

During a review of captured ICS network traffic, an analyst identifies a protocol that uses TCP port 502 and carries function codes such as 0x01 (Read Coils) and 0x05 (Write Single Coil). Which industrial protocol is the analyst observing?

In an ICS incident detection workflow, what is the purpose of triage?

Keep studying — ICS Security Operations