What is the purpose of establishing a baseline of normal operations in an ICS environment?

To document the network topology for compliance purposes

To replace the need for continuous monitoring

To provide a reference point for detecting anomalies that could indicate a threat

To ensure that all devices are running the latest firmware

A manufacturing plant wants to establish a baseline for normal network traffic on its control network to detect anomalies. The plant operates 24/7 with occasional maintenance windows. What is the best approach to create a reliable baseline?

Baseline only the highest-traffic hour each day.

Collect traffic over several weeks, including weekends and maintenance periods.

Use the vendor's default traffic patterns as the baseline.

Capture traffic for one hour during a typical production shift.

What is the primary purpose of integrating threat intelligence feeds into ICS threat hunting activities?

To provide context and indicators that help focus hunting efforts on known adversary behaviors

To ensure compliance with industry regulations

To automatically block all malicious IP addresses at the firewall

To replace the need for manual analysis of ICS traffic

GIAC Response and Industrial Defense

Domain 2Objective 2

Threat Hunting and Analysis in an ICS Environment GRID Practice Questions (Page 1)

Part of the ICS Incident Management and Intelligence domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 1–5

1foundation · easy
Which tool is commonly used for deep packet inspection of ICS protocols like Modbus and DNP3?
Select an answer first
2foundation · easy
What is the purpose of establishing a baseline of normal operations in an ICS environment?
Select an answer first
3application · medium
A manufacturing plant wants to establish a baseline for normal network traffic on its control network to detect anomalies. The plant operates 24/7 with occasional maintenance windows. What is the best approach to create a reliable baseline?
Select an answer first
4foundation · easy
Which technique is most appropriate for detecting malware that resides only in memory on an engineering workstation?
Select an answer first
5foundation · easy
What is the primary purpose of integrating threat intelligence feeds into ICS threat hunting activities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.

Threat Hunting and Analysis in an ICS Environment GRID Practice Questions (Page 1)

Questions 1–5

Which tool is commonly used for deep packet inspection of ICS protocols like Modbus and DNP3?

What is the purpose of establishing a baseline of normal operations in an ICS environment?

A manufacturing plant wants to establish a baseline for normal network traffic on its control network to detect anomalies. The plant operates 24/7 with occasional maintenance windows. What is the best approach to create a reliable baseline?

Which technique is most appropriate for detecting malware that resides only in memory on an engineering workstation?

What is the primary purpose of integrating threat intelligence feeds into ICS threat hunting activities?

Keep studying — ICS Incident Management and Intelligence