Incident Response in an ICS Environment GRID Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During an ICS incident at a power utility, the incident response team discovers that a contractor's laptop introduced malware. The contractor is on-site and insists on taking the laptop to meet a deadline. What is the BEST communication and coordination action?

   • AConfiscate the laptop and prohibit the contractor from leaving until the investigation is complete.
   • BIgnore the laptop and focus on containing the malware on the control network.
   • CAllow the contractor to take the laptop after a quick antivirus scan.
   • DCoordinate with the contractor's management to quarantine the laptop and provide an alternative clean device for the contractor's work.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic team is investigating a suspected cyber incident at a pharmaceutical plant. The plant's quality assurance team wants to resume production immediately, but the affected batch records are on the same server. What is the BEST way to preserve evidence while allowing production to resume?

   • AAllow production to resume and collect evidence later.
   • BStop production until the investigation is complete.
   • CCopy only the batch records to a USB drive and resume production.
   • DTake a forensic image of the server's storage before allowing production to resume.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During an incident at a nuclear power plant, the incident response team discovers that a vendor's remote access account was used to modify a control system configuration. The vendor is under contract and claims the change was for routine maintenance. What is the BEST coordination action?

   • ADisable the vendor's remote access account immediately and investigate the change.
   • BContact the vendor's security team to verify the maintenance activity and review the change logs.
   • CIgnore the change because the vendor has a contract.
   • DRevoke all vendor remote access permanently.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   During an ICS incident, the incident response team discovers that the adversary may have accessed a safety system. The team needs to communicate this to stakeholders. Which communication approach is most appropriate?

   • ACommunicate the potential safety impact to operators and relevant stakeholders, while keeping technical details on a need-to-know basis
   • BWait until the investigation is complete before communicating anything
   • CSend a detailed technical report to all employees immediately
   • DNotify only the IT security team and the plant manager to avoid panic
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   During a cyber incident at a food processing plant, the plant manager wants to shut down the entire production line to contain the incident, but the safety officer warns that an emergency shutdown could cause a boiler to overpressure. What is the BEST coordination action?

   • AAsk the plant manager to make the final decision without further input.
   • BIgnore the safety officer and proceed with shutdown.
   • CFollow the plant manager's order to shut down the line immediately.
   • DCoordinate with both the plant manager and safety officer to develop a containment plan that avoids the overpressure risk.
   Reveal Solution Discussion Select an answer first