Incident Response in an ICS Environment GRID Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   After a cyber incident at a pharmaceutical plant, the lessons-learned review reveals that the incident response team did not have access to up-to-date network diagrams. This delayed containment. Which improvement should be implemented?

   • AConduct more frequent security awareness training
   • BCreate a process to update network diagrams after any network change
   • CPurchase a new network monitoring tool
   • DIncrease the number of incident response team members
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A water utility's SOC receives an alert from an intrusion detection system about a suspicious SMB connection from the IT network to a historian server in the OT network. The historian is not supposed to be accessible from the IT network. What is the most appropriate immediate action?

   • ABlock the SMB connection and isolate the historian server
   • BChange the historian server's password immediately
   • CShut down the historian server to prevent data loss
   • DVerify the alert and check if any legitimate maintenance activity is scheduled
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which attack vector is specifically associated with ICS environments due to their use of specialized communication protocols?

   • ASQL injection against web applications
   • BDenial-of-service attacks on public web servers
   • CExploitation of vulnerabilities in the Modbus protocol
   • DPhishing emails targeting employees
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which characteristic is unique to threats targeting industrial control systems (ICS) compared to traditional IT systems?

   • AThe use of malware that spreads through email attachments
   • BThe potential for physical damage to equipment and harm to human safety
   • CThe reliance on standard IT operating systems and applications
   • DThe need for high-bandwidth network connectivity to the internet
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A chemical plant's safety system and control system share a network segment. An incident response team detects active malware on a control system server that communicates with the safety system. The safety system is critical for emergency shutdown. What is the BEST containment strategy that maintains safety?

   • AIsolate the control system server and keep the safety system online.
   • BDisconnect the safety system from the network to protect it.
   • CAllow the malware to run but monitor the safety system.
   • DShut down the entire network segment to contain the malware.
   Reveal Solution Discussion Select an answer first