A pipeline company has a SIEM that collects logs from the SCADA system, including PLCs, RTUs, and the historian. The security team is investigating a potential cyber attack. They notice that the historian shows a 5-minute gap in data from a pump station RTU at 3:00 AM. The RTU logs show a 'communication timeout' error at the same time. The network logs show a burst of traffic from the RTU to an unknown IP address just before the gap. What is the most likely explanation?

The RTU was rebooted by a technician during routine maintenance.

The historian's storage was full, causing it to stop recording data.

The RTU experienced a temporary network failure that caused the communication timeout and the data gap.

The RTU was compromised, and the attacker caused a communication timeout to hide the exfiltration of data to the unknown IP address.

Which of the following is an example of an ICS detection use case?

Alert when a user logs into the corporate email system

Alert when a Modbus write command is sent to a PLC outside of a maintenance window

Alert when a server's CPU usage exceeds 90%

Alert when a website is accessed from the corporate network

What is the primary purpose of establishing a normal operational baseline in ICS behavioral analytics?

To ensure all ICS traffic is encrypted

To automatically block all non-standard traffic

To identify deviations that may indicate malicious activity or system faults

To replace the need for signature-based detection

What is the purpose of ICS-specific threat signatures?

To recognize known attack patterns and indicators of compromise tailored to industrial control systems

To replace all other forms of anomaly detection

To automatically patch vulnerabilities in ICS devices

To encrypt all ICS network traffic

Which of the following is an example of an ICS-specific threat signature?

A sequence of Modbus write commands to a PLC that matches a known exploit pattern

A valid login to an HMI by an authorized operator

A firmware version that is up to date

A normal read request to a sensor that occurs every 5 seconds

GIAC Response and Industrial Defense

Domain 1Objective 2

Detection in an ICS Environment GRID Practice Questions (Page 6)

Part of the ICS Security Operations domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 7–11 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

10concepts

Questions 26–30

26expert · hard
A pipeline company has a SIEM that collects logs from the SCADA system, including PLCs, RTUs, and the historian. The security team is investigating a potential cyber attack. They notice that the historian shows a 5-minute gap in data from a pump station RTU at 3:00 AM. The RTU logs show a 'communication timeout' error at the same time. The network logs show a burst of traffic from the RTU to an unknown IP address just before the gap. What is the most likely explanation?
Select an answer first
27foundation · easy
Which of the following is an example of an ICS detection use case?
Select an answer first
28foundation · easy
What is the primary purpose of establishing a normal operational baseline in ICS behavioral analytics?
Select an answer first
29foundation · easy
What is the purpose of ICS-specific threat signatures?
Select an answer first
30foundation · easy
Which of the following is an example of an ICS-specific threat signature?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.