Incident Response in an ICS Environment GRID Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security analyst at a refinery detects a series of unusual Modbus commands from a historian to a PLC. The historian is not supposed to write to the PLC. The analyst must decide whether this is a false positive or a real incident. Which action is MOST appropriate?

   • AIgnore the alert because the historian is not a critical system.
   • BReboot the historian to clear any malicious code.
   • CCheck the historian's configuration and recent change logs to see if write access was accidentally enabled.
   • DTreat it as a real incident and immediately disconnect the historian.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which action is part of the recovery phase in ICS incident response?

   • AConducting a lessons-learned review
   • BIsolating the affected network segment
   • CCollecting forensic evidence
   • DRestoring the ICS from known-good backups
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team at a regional electrical utility is investigating a series of unexplained breaker trips. The trips correlate with network scans from a compromised laptop in the engineering department. The laptop was used by a contractor who has since left the site. The team must decide whether to treat this as a targeted attack or an opportunistic infection. Which factor is MOST indicative of a targeted attack?

   • AThe contractor used the laptop for personal browsing.
   • BThe laptop was not patched for known vulnerabilities.
   • CThe network scans specifically targeted the utility's SCADA protocol ports.
   • DThe laptop had outdated antivirus definitions.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a critical constraint when collecting forensic evidence from a live ICS environment?

   • AOnly paper logs can be used as evidence
   • BAll evidence must be collected within five minutes
   • CThe collection process must not disrupt real-time operations
   • DEvidence must be collected only after the system is shut down
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A forensic investigator needs to collect evidence from a live PLC that controls a critical manufacturing process. The PLC uses a proprietary protocol and cannot be stopped. What is the most appropriate evidence collection approach?

   • APerform a memory dump of the PLC using the vendor's diagnostic tool.
   • BPhysically remove the PLC and image its firmware in a lab.
   • CReboot the PLC to clear any malicious code before capturing logs.
   • DCapture network traffic to and from the PLC and record its current logic and configuration via the vendor's read-only interface.
   Reveal Solution Discussion Select an answer first