A wastewater plant's historian shows a series of unauthorized writes to a PLC's setpoints during off-hours. The writes originated from an IP address in the plant's corporate network. Which triage step is MOST critical before declaring an incident?

Reboot the PLC to clear any malicious logic.

Immediately block the corporate IP address at the firewall.

Notify law enforcement right away.

Check if any scheduled maintenance or remote access was approved for that time.

What is the primary purpose of the lessons learned phase in ICS incident response?

Delete all evidence related to the incident

Identify improvements to security controls and response procedures

Restore systems to their pre-incident state

Assign blame to individuals for the incident

During an incident at a natural gas pipeline, analysts confirm malware on a SCADA server that communicates with remote terminal units (RTUs) controlling valve positions. Operations must continue to monitor pressures. Which containment strategy BEST balances safety and operational continuity?

Place the SCADA server in a network quarantine while allowing read-only monitoring traffic to RTUs.

Disconnect the SCADA server from the network and operate RTUs manually.

Shut down the SCADA server and rely on physical inspections of valve positions.

Allow the SCADA server to continue operating but block all outbound traffic to the corporate network.

Which output is a typical result of the lessons learned phase?

A list of employees to terminate

Updated incident response plans and procedures

A manufacturing company has just experienced a ransomware incident that affected its IT network but not the OT network. During the lessons-learned phase, what is the MOST important action to prevent a similar incident from reaching the OT network?

Increase the frequency of OT network backups.

Implement network segmentation and strict access controls between IT and OT.

Train all employees on phishing awareness.

Purchase cyber insurance to cover potential OT losses.

GIAC Response and Industrial Defense

Domain 2Objective 1

Incident Response in an ICS Environment GRID Practice Questions (Page 5)

Part of the ICS Incident Management and Intelligence domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 21–25

21application · medium
A wastewater plant's historian shows a series of unauthorized writes to a PLC's setpoints during off-hours. The writes originated from an IP address in the plant's corporate network. Which triage step is MOST critical before declaring an incident?
Select an answer first
22foundation · easy
What is the primary purpose of the lessons learned phase in ICS incident response?
Select an answer first
23application · medium
During an incident at a natural gas pipeline, analysts confirm malware on a SCADA server that communicates with remote terminal units (RTUs) controlling valve positions. Operations must continue to monitor pressures. Which containment strategy BEST balances safety and operational continuity?
Select an answer first
24foundation · easy
Which output is a typical result of the lessons learned phase?
Select an answer first
25application · medium
A manufacturing company has just experienced a ransomware incident that affected its IT network but not the OT network. During the lessons-learned phase, what is the MOST important action to prevent a similar incident from reaching the OT network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.