Monitoring in an ICS Environment GRID Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which characteristic most distinguishes ICS network monitoring from traditional IT monitoring?

   • AICS monitoring must account for real-time operational constraints and the impact on physical processes.
   • BICS monitoring uses the same tools and protocols as IT monitoring without modification.
   • CICS monitoring prioritizes data confidentiality over availability and integrity.
   • DICS monitoring focuses on detecting security threats, while IT monitoring focuses on performance.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A regional electrical utility must demonstrate to its regulator that it has monitored all remote substation gateways for unauthorized access attempts over the past quarter. The gateways are spread across a wide geographic area and have limited bandwidth. Which monitoring data source would be the most practical and compliant approach?

   • AConfigure the gateways to send an email alert to the security team only when a failed login occurs.
   • BCollect and forward authentication logs from each gateway to a central SIEM for review and retention.
   • CSend a technician to each substation to manually review the gateway's local event logs every month.
   • DDeploy a full packet capture appliance at each substation and store all traffic locally for the quarter.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A manufacturing plant uses a mix of modern Ethernet-based PLCs and legacy serial devices. The security team wants to deploy a single monitoring tool that can provide visibility into both types of devices without disrupting operations. Which tool characteristic is most important for this environment?

   • ASupport for both passive network monitoring and serial protocol parsing.
   • BA cloud-based dashboard that requires internet connectivity to view alerts.
   • CIntegration with the plant's enterprise Active Directory for user authentication.
   • DAbility to actively scan all devices to build a complete asset inventory.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large utility is designing a monitoring solution for its OT network. The network includes legacy serial devices that cannot be patched and modern IP-based devices. The security team wants to detect intrusions without risking disruption to the legacy devices. They also need to provide real-time alerts to operators. Which approach best balances these competing requirements?

   • AUse a SIEM that collects logs only from modern IP-based devices and ignores legacy serial traffic.
   • BDeploy passive network taps on all OT segments and use a protocol-aware IDS that generates alerts based on behavioral baselines.
   • CReplace all legacy serial devices with modern IP-based devices that support encryption and logging.
   • DDeploy an active vulnerability scanner that runs weekly to identify unpatched legacy devices.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A pharmaceutical manufacturer must provide evidence to a regulator that its batch reactor temperature remained within a safe range during a specific production run. The historian contains process data, but the security team is unsure whether the historian data alone is sufficient. Which additional data source would most directly support the compliance report?

   • AFirewall logs showing all outbound internet traffic from the corporate network during the production run.
   • BA network diagram of the plant's Wi-Fi coverage areas.
   • CAlarm and event logs from the DCS that show when temperature alarms were acknowledged and by whom.
   • DThe vendor's manual for the reactor's temperature sensor, including calibration instructions.
   Reveal Solution Discussion Select an answer first