An ICS security team wants to monitor a serial-based legacy fieldbus that is not IP-based. Which tool is most appropriate?

A serial tap or protocol converter that feeds into an ICS-aware monitoring platform.

A host-based agent installed on the PLC.

A standard network IDS connected to the Ethernet switch.

A wireless sniffer tuned to the 2.4 GHz band.

A chemical plant wants to monitor a legacy DCS that uses a proprietary protocol over serial links. The vendor does not provide any logging or management interface. The security team needs visibility into the protocol traffic without risking disruption. Which monitoring approach is most appropriate?

Connect a laptop to the serial link and run a packet capture tool in promiscuous mode.

Replace the DCS with a modern system that supports standard logging.

Install a passive tap on the serial link and use a protocol-aware monitoring tool that can parse the proprietary protocol.

Use an active protocol converter to translate the serial traffic to Ethernet for monitoring.

Which tool is specifically designed to parse and analyze industrial protocols for ICS monitoring?

Wireshark with standard IT dissectors

Zeek (formerly Bro) with ICS protocol analyzers

A power generation facility has a monitoring system that generates a high volume of low-severity alerts. The security team is concerned that operators are ignoring alerts because of the noise. Which approach would most effectively improve the alerting process?

Disable all low-severity alerts to eliminate the noise.

Send all alerts directly to the plant manager for immediate action.

Increase the severity of all alerts so operators pay more attention to them.

Tune the alert rules to reduce false positives and prioritize alerts based on the criticality of the affected asset.

Which activity is an example of active monitoring in an ICS network?

Capturing packets from a SPAN port

Sending a ping to an RTU to check availability

Reviewing logs from a historian

GIAC Response and Industrial Defense

Domain 1Objective 3

Monitoring in an ICS Environment GRID Practice Questions (Page 9)

Part of the ICS Security Operations domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 7–11 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 41–45

41application · medium
An ICS security team wants to monitor a serial-based legacy fieldbus that is not IP-based. Which tool is most appropriate?
Select an answer first
42application · medium
A chemical plant wants to monitor a legacy DCS that uses a proprietary protocol over serial links. The vendor does not provide any logging or management interface. The security team needs visibility into the protocol traffic without risking disruption. Which monitoring approach is most appropriate?
Select an answer first
43foundation · easy
Which tool is specifically designed to parse and analyze industrial protocols for ICS monitoring?
Select an answer first
44application · medium
A power generation facility has a monitoring system that generates a high volume of low-severity alerts. The security team is concerned that operators are ignoring alerts because of the noise. Which approach would most effectively improve the alerting process?
Select an answer first
45foundation · easy
Which activity is an example of active monitoring in an ICS network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.