Incident Response in an ICS Environment GRID Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary goal of the eradication phase in ICS incident response?

   • ARestore systems from backups
   • BRemove the threat from the environment
   • CCommunicate with stakeholders
   • DIdentify the scope of the incident
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   After a significant ICS incident, the response team completes the after-action review. Which action is MOST aligned with the lessons-learned phase?

   • APurchase additional security tools to prevent future incidents.
   • BDelete all incident-related logs to free up storage.
   • CUpdate the incident response plan with new detection signatures and containment procedures.
   • DConduct a security awareness training for all employees.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which group is essential to include in ICS incident response coordination?

   • AMarketing department
   • BControl system engineers
   • CHuman resources
   • DExternal auditors
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is a key consideration when selecting containment measures for an ICS incident?

   • AThe cost of the containment tools
   • BThe preference of the incident responder
   • CThe need to preserve all network traffic logs
   • DThe impact on the safety and reliability of the industrial process
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A water treatment facility's SIEM alerts on repeated Modbus write requests to a PLC controlling chlorine dosing, originating from an engineering workstation that has been offline for maintenance. The requests are incrementing the setpoint beyond normal operating range. Operators confirm no scheduled change. What should be the FIRST triage action?

   • AShut down the PLC to prevent unsafe chlorine levels.
   • BIsolate the engineering workstation from the control network immediately.
   • CVerify with operations whether any recent maintenance or testing could explain the writes, then correlate with network logs.
   • DBlock all Modbus traffic on the control network to stop the writes.
   Reveal Solution Discussion Select an answer first