Monitoring in an ICS Environment GRID Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A water utility's monitoring system flags a series of Modbus write commands to a pump station's PLC that occur outside the normal maintenance window. The commands are coming from an IP address that is not in the asset inventory. The operator confirms the pump is running normally. Which action should the security team take first?

   • AIgnore the alert because the pump is running normally and no operational impact is observed.
   • BReboot the PLC to clear any malicious logic that may have been uploaded.
   • CChange the PLC's password immediately to prevent further unauthorized access.
   • DIsolate the pump station from the network and begin a forensic investigation of the source IP and the commands sent.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A water treatment facility uses a legacy PLC that communicates over an unencrypted serial protocol. The ICS security team wants to add monitoring to detect an attacker who has already gained access to the OT network and is sending unauthorized write commands to this PLC. The team is concerned that active scanning could disrupt the PLC's time-critical control loop. Which monitoring approach best balances detection capability with operational safety?

   • AConfigure the PLC's built-in SNMP agent to send periodic trap messages to the SIEM, and enable read-write community strings for full visibility.
   • BDeploy a passive network tap on the serial link and analyze protocol traffic for command patterns that deviate from the baseline.
   • CRun a vulnerability scanner against the PLC every hour to identify any new open ports or services that the attacker may have enabled.
   • DPlace an active inline security appliance between the PLC and the HMI that blocks any command not on an approved whitelist.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A food processing plant must comply with a safety standard that requires tracking operator access to the control system. Which data source is most directly relevant?

   • AAuthentication logs from the HMI and engineering workstations.
   • BPhysical security badge logs at the plant entrance.
   • CNetwork traffic captures of all Modbus communications.
   • DProcess historian data showing temperature and pressure trends.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A manufacturing plant's monitoring system detects that a PLC's program has been modified, but there was no corresponding change request. What is the most appropriate immediate action?

   • AAlert the OT manager and isolate the PLC from the network if possible.
   • BReboot the PLC to restore the original program.
   • CImmediately shut down the entire production line.
   • DIgnore the change because it might be a scheduled update.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A natural gas utility must comply with a regulation that requires monitoring of all remote pipeline valve actuators. The actuators are connected via a low-bandwidth satellite link. The compliance team wants to retain all monitoring data for two years. The security team is concerned about bandwidth and storage costs. Which strategy best meets the compliance requirement while managing resource constraints?

   • ACollect only security-relevant events, such as authentication failures and configuration changes, and store them centrally in a compressed format.
   • BSend all logs to a cloud SIEM in real time, regardless of bandwidth costs.
   • CStore logs locally on the actuators and only transmit them when an alert is triggered.
   • DCollect full packet capture from all actuators and store it locally on each device for two years.
   Reveal Solution Discussion Select an answer first