Monitoring in an ICS Environment GRID Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A power utility wants to detect a cyber intrusion that manipulates sensor readings to hide a physical breach. Which combination of monitoring data sources would be most effective?

   • AUse only the HMI's built-in event log.
   • BOnly collect firewall logs from the IT/OT boundary.
   • CMonitor only the historian database for unusual SQL queries.
   • DCompare process data from the historian with network traffic and physical alarm logs.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A food processing plant's IT team wants to apply the same intrusion detection rules used on the corporate network to the OT network. The OT network uses proprietary industrial protocols and has devices that are sensitive to broadcast traffic. What is the most important consideration before deploying these rules?

   • AThe rules should be disabled during peak production hours to avoid any impact on the OT network.
   • BThe rules must be adapted to the OT protocols and tuned to avoid false positives that could desensitize operators to real alerts.
   • CThe rules should be replaced with a full packet capture system that records all traffic for later analysis.
   • DThe rules should be deployed exactly as-is to ensure consistent security across both networks.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What type of report is commonly generated from ICS monitoring data to demonstrate compliance?

   • AA report detailing the chemical composition of raw materials
   • BA report summarizing network traffic volumes for capacity planning
   • CA report of employee performance metrics
   • DA report listing all security incidents and the actions taken to resolve them
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A water treatment facility has a flat OT network with legacy PLCs that do not support modern logging. The security team wants to add monitoring without risking disruption to the control process. Which approach best fits these constraints?

   • AConfigure the PLCs to send syslog to a central server using their built-in logging features.
   • BPlace a firewall between the PLCs and the HMI to log all traffic and block anomalies.
   • CDeploy a passive network tap on the OT switch mirror port and analyze traffic with an ICS-aware IDS.
   • DInstall an active vulnerability scanner on the OT network to identify weaknesses in the PLCs.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which monitoring technique is most effective for detecting a new, unauthorized device connecting to an ICS network?

   • AReviewing firewall logs for blocked traffic
   • BAnalyzing network traffic for new MAC or IP addresses
   • CMonitoring process variable values
   • DChecking PLC ladder logic
   Reveal Solution Discussion Select an answer first