Threat Hunting and Analysis in an ICS Environment GRID Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A security team at a wind farm receives a threat intelligence report about a new ICS malware that uses OPC UA to communicate with controllers. The report includes a YARA rule and a list of malicious OPC UA server IPs. The team has limited time and must decide how to use this intelligence effectively. They have access to network captures and endpoint logs. What is the most efficient approach?

   • ABlock all OPC UA traffic to prevent any potential infection.
   • BWait for the antivirus vendor to update signatures before taking action.
   • CSearch all network captures for connections to the malicious IPs and run the YARA rule on all endpoints.
   • DFocus on analyzing OPC UA traffic patterns for anomalies, regardless of the IOCs.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   During a hunt on an engineering workstation, the team finds a suspicious DLL loaded into a process that communicates with an external IP. The workstation is critical for plant operations and cannot be taken offline. What is the best course of action to gather evidence while minimizing disruption?

   • AReboot the workstation to clear the DLL from memory
   • BKill the process immediately to stop the communication
   • CPerform a live memory capture and analyze the DLL's behavior
   • DDisconnect the workstation from the network
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A hunt team is investigating a suspected advanced persistent threat (APT) on a set of HMIs. They have collected memory dumps and file system images. They need to identify malware that is designed to evade signature-based detection. Which combination of techniques is most effective?

   • ANetwork traffic analysis to identify command-and-control communications
   • BMemory analysis for hidden processes and code injection, combined with log correlation
   • CFile system analysis for recently modified files
   • DYARA rule scanning on the file system and memory dumps
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A regional water utility has a mature security program but limited staffing. They have a hypothesis that a sophisticated adversary may have established persistence in their SCADA environment. They have access to historian logs, PLC program files, and network flow data. The team must choose a hunting approach that balances thoroughness with limited resources. Which approach is most effective?

   • AImmediately replace all PLCs with new ones to eliminate any persistence.
   • BConduct a full memory analysis of all HMIs and engineering workstations.
   • CStart with network flow analysis to identify anomalies, then follow up on suspicious hosts with deeper analysis.
   • DReview only the historian logs for setpoint changes.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A security manager at a food processing plant wants to implement threat hunting to complement their existing IDS. The manager is concerned about the impact on production. What is the most important principle to communicate to the team?

   • AThreat hunting should focus only on IT systems to avoid OT disruption
   • BThreat hunting should be performed only during scheduled maintenance windows
   • CThreat hunting should use passive data sources and avoid active scanning of production systems
   • DThreat hunting should be performed by external consultants to avoid internal bias
   Reveal Solution Discussion Select an answer first