Detection in an ICS Environment GRID Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A refinery's security operations center (SOC) receives an alert from the SIEM: a PLC on the crude unit has been writing to a different PLC's memory area using Modbus function code 16 (Write Multiple Registers). The source PLC is not configured to communicate with the target PLC. The SOC analyst is following the incident detection workflow. What is the first step the analyst should take?

   • AIsolate the source PLC from the network immediately to stop the attack.
   • BSearch the internet for the Modbus function code 16 to understand what it does.
   • CEscalate the alert to the highest severity level because it involves a PLC-to-PLC communication.
   • DVerify the alert by checking the source PLC's configuration and recent logs to confirm it is not a legitimate new communication path.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of a behavioral deviation that might be detected in an ICS environment?

   • AA PLC that continues to poll a sensor at the same interval every day
   • BA PLC that normally polls a sensor every 10 seconds suddenly polls every 1 second
   • CA historian that records data at the same rate as configured
   • DAn HMI that displays the same process values as it did yesterday
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A chemical plant uses Modbus TCP between a DCS and several PLCs. The security team has a passive monitor and has established a baseline. The baseline shows that the DCS polls each PLC every 1 second with function code 3, and writes setpoints with function code 6 during shift changes. One day, the monitor detects a series of function code 16 (Write Multiple Registers) commands from the DCS to a PLC that controls a reactor temperature. The writes are changing multiple registers at once, and the values are within the normal operating range. The DCS logs show no corresponding operator action. What is the most appropriate response?

   • ABlock all function code 16 traffic from the DCS to the PLC at the firewall.
   • BIgnore the alert because the values are within the normal operating range and the source is the trusted DCS.
   • CUpdate the baseline to include function code 16 because the DCS is authorized to write to the PLC.
   • DTreat this as a potential compromise of the DCS and investigate the source of the function code 16 commands, correlating with DCS logs and network flows.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A water utility's SOC receives an alert from the SIEM: a PLC on the distribution network has been writing to a different PLC's memory area using Modbus function code 16 (Write Multiple Registers). The source PLC is not configured to communicate with the target PLC. The SOC analyst is following the incident detection workflow. The analyst has verified the alert and confirmed it is not a false positive. What is the next step in the workflow?

   • ASearch the internet for the Modbus function code 16 to understand what it does.
   • BClose the alert because the source PLC is on the trusted control network.
   • CEscalate the alert to the incident response team with all relevant context, including the source and target PLCs, the function code, and the timing.
   • DIsolate the source PLC from the network immediately to stop the attack.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A pharmaceutical plant has deployed a new ICS intrusion detection system (IDS). The IDS is generating a high volume of alerts, most of which are false positives. The alerts are triggered by normal operational events, such as batch start/stop commands and temperature setpoint changes. The security team wants to reduce false positives without missing genuine threats. Which approach is most effective?

   • ACreate a baseline of normal batch operations and configure the IDS to alert only on deviations from this baseline.
   • BReview each alert manually and whitelist the source IPs of the HMIs that send the commands.
   • CIncrease the alert threshold so that only alerts with a severity score above 8 are shown.
   • DDisable the IDS alerts for batch start/stop commands and temperature setpoint changes.
   Reveal Solution Discussion Select an answer first