Monitoring in an ICS Environment GRID Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a common open-source tool used for passive ICS network monitoring?

   • ANessus
   • BGRASSMARLIN
   • CMetasploit
   • DBurp Suite
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A hospital's building management system (BMS) is monitored by the IT security team, but the facilities team is responsible for the HVAC equipment. The monitoring system generates an alert for a suspected malware infection on a BMS controller. The IT team wants to quarantine the controller, but the facilities team says that would disrupt the operating room's temperature control. What is the most appropriate response?

   • AAsk the facilities team to reboot the controller to clear the malware.
   • BIgnore the alert because the BMS is not part of the clinical network.
   • CQuarantine the controller immediately to contain the malware, regardless of the operational impact.
   • DCoordinate with the facilities team to assess the operational impact and implement a temporary workaround before quarantining the controller.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why is passive monitoring often preferred over active monitoring in an ICS environment?

   • APassive monitoring does not inject traffic or queries that could disrupt real-time control.
   • BPassive monitoring uses less network bandwidth than active monitoring.
   • CPassive monitoring can detect all types of attacks that active monitoring can.
   • DPassive monitoring is easier to deploy because it does not require network access.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A manufacturing plant's SOC receives an alert about a suspicious Modbus command from an unknown IP. The on-call analyst is unfamiliar with OT protocols. What is the most appropriate first response?

   • AShut down the affected PLC to prevent damage.
   • BImmediately block the unknown IP at the firewall.
   • CIgnore the alert because Modbus is a legacy protocol.
   • DEscalate to the OT engineering team to verify whether the command is legitimate.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is a primary challenge when monitoring legacy ICS protocols?

   • ALegacy protocols are proprietary and lack standardized logging or packet inspection support.
   • BLegacy protocols generate too much data to be captured by any monitoring system.
   • CLegacy protocols are always encrypted, making deep packet inspection impossible.
   • DLegacy protocols are only used on air-gapped networks, so monitoring is unnecessary.
   Reveal Solution Discussion Select an answer first