Monitoring in an ICS Environment GRID Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A mining company wants to monitor its OT network, which includes PLCs from multiple vendors using different industrial protocols. The team is evaluating monitoring tools and needs one that can provide a unified view of the entire OT environment. Which tool capability is most important?

   • ASupport for multiple ICS protocols and the ability to normalize data into a common format.
   • BA mobile app that allows operators to view alerts from anywhere.
   • CIntegration with the corporate email system for alert notifications.
   • DA built-in vulnerability scanner that can actively test all PLCs.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A regional water utility must demonstrate to regulators that it monitors its treatment process for anomalies. Which monitoring practice best supports this compliance requirement?

   • ARely on verbal reports from operators instead of written records.
   • BDelete logs older than 30 days to reduce storage costs.
   • CRetain historian logs and alarm records for the required period and produce periodic reports.
   • DOnly monitor the IT network because regulators care about cyber threats.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A natural gas pipeline operator's SIEM generates an alert for a suspected brute-force attack on an HMI workstation. The on-call analyst is unfamiliar with the OT environment and escalates the alert to the control room operator, who is busy managing a pressure transient. What is the most appropriate escalation and response procedure for this situation?

   • AIgnore the alert because brute-force attacks on HMIs are common and rarely succeed.
   • BSend an email to all control room operators describing the alert and asking them to change their passwords.
   • CHave the analyst verify the alert against OT-specific context, such as whether the HMI is exposed to the IT network, before escalating to the operator.
   • DImmediately escalate the alert to the plant manager and request a full shutdown of the HMI.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which data source provides the most direct indication of the physical state of an ICS process?

   • AWindows event logs from engineering workstations
   • BFirewall logs
   • CNetwork flow records
   • DProcess data from PLCs and sensors
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A wastewater plant's monitoring system generates an alert when a pump's runtime exceeds its normal operating window. The operator checks the historian and sees that the pump has been running longer than usual but the process is stable. What is the most appropriate next step?

   • ADismiss the alert because the process is stable and no immediate safety issue exists.
   • BTreat the alert as a potential anomaly and investigate whether a control logic change or external command caused the extended runtime.
   • CReboot the pump's PLC to reset the runtime counter.
   • DIncrease the alert threshold so future extended runtimes do not trigger alerts.
   Reveal Solution Discussion Select an answer first