Monitoring in an ICS Environment GRID Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which factor is most important when designing an alerting system for an ICS environment?

   • ASending alerts only to external security vendors
   • BUsing the same alert thresholds as the IT network
   • CMinimizing false positives while ensuring critical events are not missed
   • DAlerting on every minor deviation to ensure no event is missed
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of an escalation procedure in ICS monitoring?

   • ATo increase the volume of alerts sent to operators
   • BTo prioritize alerts based on the source IP address
   • CTo ensure that alerts are forwarded to higher-level personnel if not resolved within a specified time
   • DTo automatically shut down the ICS process when an alert is triggered
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A refinery's security team is building a monitoring solution and wants to detect both cyber intrusions and process safety issues. They have access to firewall logs, historian data, and alarm logs. Which combination of data sources would provide the most comprehensive monitoring coverage?

   • AAlarm logs only, because they capture both process and security events.
   • BFirewall logs only, because cyber intrusions are the primary threat to the refinery.
   • CHistorian data only, because process deviations are the most important indicator of safety issues.
   • DFirewall logs for network anomalies, historian data for process deviations, and alarm logs for operator response.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A chemical plant uses a mix of modern and legacy controllers. The team wants to detect unauthorized changes to control logic but is concerned about the performance impact of active polling. Which monitoring technique should they prioritize?

   • ADisable all remote access to controllers to prevent unauthorized changes.
   • BUse a protocol-aware firewall to block all write commands from the HMI.
   • CPassively monitor network traffic to identify unusual write commands to controllers.
   • DActively poll each controller's program signature every few minutes.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A pipeline operator wants to detect a man-in-the-middle attack that alters control commands in transit. Which monitoring technique is most effective?

   • AActively send test packets to the PLC to verify its response.
   • BRely on the PLC's built-in error logs.
   • CUse a firewall to block all traffic from unknown IPs.
   • DPassively compare the actual network traffic with the expected command sequence from the HMI.
   Reveal Solution Discussion Select an answer first