Detection in an ICS Environment GRID Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A manufacturing plant has a historian that logs all process values from PLCs every second. The security team wants to use behavioral analytics to detect anomalies. They have six months of historical data. The plant operates 24/7, but production slows on weekends. The team is configuring an anomaly detection tool. What is the most important factor to consider to minimize false positives?

   • ABuild separate baselines for weekdays and weekends to account for the different production schedules.
   • BOnly analyze data from the last week to ensure the baseline reflects current operations.
   • CDisable alerts for any process value that has never changed in the historical data.
   • DUse a single global threshold for all process values to keep the configuration simple.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the first step in a structured ICS incident detection workflow?

   • AImplementing a patch to fix the vulnerability
   • BDetecting a potential security incident through monitoring and alerting
   • CEscalating the incident to senior management
   • DConducting a full forensic investigation
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A water treatment facility uses Modbus TCP between a SCADA master and multiple PLCs. The security team recently deployed a passive network monitor and wants to baseline normal traffic. Over a week, they observe that the master polls each PLC every 500 ms with function code 3 (Read Holding Registers), and occasionally writes setpoints with function code 6 (Write Single Register) during shift changes. One afternoon, the monitor flags a burst of function code 5 (Write Single Coil) commands from the master to a specific PLC at 10-second intervals for 30 minutes. The PLC is a dosing pump controller that has never received coil writes in the baseline. What is the most appropriate immediate action?

   • AInvestigate the write commands as a potential anomaly, correlating the timing and function code with the shift-change schedule and checking the PLC's historian for corresponding output changes.
   • BSuppress the alert because the source is the trusted SCADA master, not an unknown IP.
   • CImmediately block the SCADA master's IP at the firewall to prevent further writes.
   • DUpdate the baseline to include function code 5 because the master is authorized to write coils.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a common type of anomaly that ICS protocol anomaly detection is designed to identify?

   • AUnexpected source or destination addresses in protocol messages
   • BA valid function code used within its defined range
   • CA consistent polling interval between a master and a remote terminal unit (RTU)
   • DA response with a correct checksum
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is an example of ICS log correlation?

   • ACorrelating a PLC alarm log with a historian data log to identify the cause of a process upset
   • BReviewing a single HMI log for user logins
   • CStoring all logs in a centralized repository without analysis
   • DDeleting logs older than 30 days
   Reveal Solution Discussion Select an answer first