Incident Response in an ICS Environment GRID Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a key communication consideration during an ICS incident?

   • AEnsure that technical information is shared in a way that is understandable to all stakeholders
   • BShare all technical details with the public immediately
   • CCommunicate only through email
   • DKeep all information confidential from external stakeholders
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which containment strategy is most appropriate for an ICS incident when the affected process must continue operating to maintain safety?

   • ADisconnect all remote access and ignore the incident
   • BShut down the entire ICS immediately
   • CFormat all hard drives in the control network
   • DIsolate the affected ICS network segment while allowing manual control
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During an incident at a natural gas facility, the incident response team needs to communicate with the control room operators. The operators are not IT experts. What is the most effective way to communicate the situation?

   • AProvide a brief, clear summary of the incident and specific instructions for safe operation
   • BKeep the incident confidential to avoid panic
   • CSend a detailed technical analysis of the malware to the operators
   • DAsk the operators to stop all processes until further notice
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   After a ransomware incident at a food processing plant, the response team completes eradication and recovery. During the lessons-learned review, they identify that the malware entered through a vendor remote-access account with weak credentials. Which improvement should be prioritized to prevent a similar incident?

   • AImplement multi-factor authentication for all remote-access accounts
   • BIncrease the frequency of antivirus scans on OT workstations
   • CSchedule more frequent backups of the PLC configurations
   • DDeploy a new firewall between the IT and OT networks
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A forensic investigator is called to a natural gas compressor station where a cyber incident is suspected. The station's RTUs use a proprietary protocol, and the operator wants to continue remote monitoring. Which evidence collection method BEST preserves evidence while allowing continued monitoring?

   • AReplace the RTUs with spares and analyze the originals offline.
   • BRely solely on the operator's verbal description of the incident.
   • CCapture network traffic at the switch and use the vendor's read-only diagnostic interface to query RTU status.
   • DPower down the RTUs and remove their memory chips for imaging.
   Reveal Solution Discussion Select an answer first