Monitoring in an ICS Environment GRID Practice Questions (Page 10)

Questions 46–47

1. 46expert · hard

   A refinery's SOC uses an IT-style SIEM that generates hundreds of alerts per day from OT traffic. The OT team is overwhelmed and has started ignoring alerts. The security manager wants to improve the situation without reducing security coverage. What is the most effective change?

   • AIncrease the alert threshold so only critical alerts are generated.
   • BCreate OT-specific alert rules based on baselines of normal process behavior and suppress known-good traffic.
   • CRoute all OT alerts to the IT helpdesk for initial triage.
   • DDisable the SIEM and rely on manual log reviews by the OT team.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   An ICS security analyst notices that a PLC in a power substation is sending an unusually high volume of Modbus read requests to a different PLC that it normally only writes to. The analyst checks the asset inventory and confirms the source PLC is not scheduled for any new logic. Which monitoring technique would be most effective at identifying whether this behavior is malicious?

   • AReboot the source PLC to clear any potential malware from its memory.
   • BDisable the source PLC's network port until the traffic stops.
   • CCompare the observed traffic pattern against a baseline of normal PLC-to-PLC communication and investigate any deviation.
   • DCheck the PLC's web server logs for any recent login attempts.
   Reveal Solution Discussion Select an answer first