A utility must comply with a regulation that requires monitoring of all remote access sessions to its substations. The current solution logs sessions but does not alert on suspicious activity. The compliance auditor requires evidence of both monitoring and response. What is the best improvement?

Disable remote access entirely to eliminate the risk.

Increase the frequency of manual log reviews to weekly.

Implement automated alerting on remote access anomalies and retain session logs for the required period.

Store logs in an encrypted format but do not review them.

How does ICS monitoring support compliance with regulatory requirements?

By eliminating the need for external audits

By providing audit trails and evidence that security controls are operating effectively

By guaranteeing that no security breaches occur

By automatically enforcing all compliance rules without human intervention

A small water plant with a single operator wants to monitor its ICS without hiring additional staff. Which tool is most appropriate?

A standalone vulnerability scanner run monthly.

A spreadsheet-based log review process.

A cloud-based SIEM with managed detection and response services.

An on-premises open-source IDS that requires daily tuning.

A hospital's building automation system (BAS) uses BACnet. The security team wants to set up monitoring but is worried about overwhelming the small OT team with alerts. What is the best approach?

Set alerts to trigger on any BACnet traffic because it is a legacy protocol.

Disable alerts and only review logs monthly.

Tune alert thresholds based on a baseline of normal BACnet traffic and route alerts to a shared on-call rotation.

Forward all alerts to the IT helpdesk for triage.

In ICS monitoring, what does a sudden change in the frequency of Modbus polling requests from a single source typically indicate?

A potential anomaly that warrants investigation

GIAC Response and Industrial Defense

Domain 1Objective 3

Monitoring in an ICS Environment GRID Practice Questions (Page 7)

Part of the ICS Security Operations domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 7–11 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 31–35

31expert · hard
A utility must comply with a regulation that requires monitoring of all remote access sessions to its substations. The current solution logs sessions but does not alert on suspicious activity. The compliance auditor requires evidence of both monitoring and response. What is the best improvement?
Select an answer first
32foundation · easy
How does ICS monitoring support compliance with regulatory requirements?
Select an answer first
33application · medium
A small water plant with a single operator wants to monitor its ICS without hiring additional staff. Which tool is most appropriate?
Select an answer first
34application · medium
A hospital's building automation system (BAS) uses BACnet. The security team wants to set up monitoring but is worried about overwhelming the small OT team with alerts. What is the best approach?
Select an answer first
35foundation · easy
In ICS monitoring, what does a sudden change in the frequency of Modbus polling requests from a single source typically indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.