Monitoring in an ICS Environment GRID Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A power utility's monitoring system detects a series of small, incremental changes to a transformer's tap changer setpoint over several hours. Each change is within the normal operating range, but the cumulative effect is a significant deviation from the baseline. The operator has not initiated any changes. What is the most likely explanation and appropriate response?

   • AThe changes are a false positive caused by a sensor calibration issue; recalibrate the sensor.
   • BThe changes are the result of a scheduled maintenance routine; confirm with the maintenance team.
   • CThe changes may be the result of a slow-moving cyber attack or a malfunctioning control logic; investigate the source of the setpoint changes.
   • DThe changes are likely due to normal load variations and require no action.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A power plant has a mix of modern Ethernet-based PLCs and legacy serial RTUs. The security team wants to monitor both, but the serial RTUs are on a network that cannot tolerate any added latency. Which monitoring strategy best balances visibility and safety?

   • AMonitor only the Ethernet PLCs and rely on manual checks for the serial RTUs.
   • BInstall an active polling agent on the serial RTUs to collect data.
   • CReplace the serial RTUs with Ethernet-based devices to simplify monitoring.
   • DDeploy passive taps on both the Ethernet and serial segments, using protocol-aware analyzers for each.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of a monitoring data source that captures network-level communication details in an ICS?

   • AHistorian database
   • BSyslog from a PLC
   • CNetFlow records from a switch
   • DModbus register values
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A water utility wants to detect a sophisticated attacker who is using valid credentials to issue normal-looking commands. The attacker's commands are within normal operational parameters. Which monitoring approach is most likely to detect this?

   • ARely on the PLC's built-in audit logs.
   • BMonitor only the firewall logs for external connections.
   • CUse a signature-based IDS to match known attack patterns.
   • DCorrelate user authentication logs with command sequences and compare against a baseline of user behavior.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An oil refinery's monitoring system flags a series of Modbus read requests that occur at 3:00 AM every day. The requests come from a known engineering workstation. What is the most likely explanation?

   • AA scheduled maintenance script that polls process values.
   • BThe monitoring system is generating false positives due to a configuration error.
   • CA cyber attacker has compromised the workstation and is mapping the network.
   • DThe Modbus protocol is malfunctioning and generating false traffic.
   Reveal Solution Discussion Select an answer first