Threat Hunting and Analysis in an ICS Environment GRID Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard · select all that apply

   A security analyst is conducting a hunt for a sophisticated adversary that may have compromised an HMI and is using it as a pivot point to reach PLCs. The analyst has access to Wireshark, YARA, memory analysis tools, and the HMI's event logs. Which combination of techniques would provide the most comprehensive detection of this activity? Select all that apply.

   • APerform memory analysis on the HMI to identify malicious processes.
   • BRun YARA rules on the HMI's file system to detect known malware.
   • CCapture and analyze network traffic from the HMI to PLCs for unusual Modbus commands.
   • DReview the HMI's event logs for failed login attempts.
   Check answers Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an ICS-specific data source that is commonly used for threat hunting?

   • AHistorian logs
   • BDNS query logs
   • CActive Directory logs
   • DWeb server access logs
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A pharmaceutical plant has a well-established baseline for its batch process. During a hunt, an analyst notices that the temperature setpoint for a reactor has been changed by 0.5°C during a batch, which is within the normal variation range. However, the change occurred at 3:00 AM, which is outside the normal shift schedule. The analyst must decide whether this is a threat or a benign anomaly. What is the best approach?

   • AImmediately shut down the reactor to prevent a potential safety issue.
   • BIgnore it because the change is within the normal range.
   • CInvestigate the change by correlating the timestamp with operator logs and access records.
   • DAdjust the baseline to include 3:00 AM changes.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is reviewing a packet capture from a power utility's DNP3 network. The capture shows a master station polling a remote terminal unit (RTU) every 5 seconds, but at 02:13:45, a single unsolicited response containing a control command is sent from the RTU to the master. What is the most significant anomaly to investigate?

   • AThe polling interval changed from 5 seconds to a different value
   • BThe RTU sent an unsolicited control command, which is atypical for a slave device
   • CThe master station failed to acknowledge the RTU's response
   • DThe RTU's IP address is not in the asset inventory
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During a hunt, an analyst discovers that a PLC's program file has been modified, but the change is not documented in the change management system. The PLC is still running the process normally. What is the most appropriate action?

   • AReport the change to management but take no further action.
   • BCompare the current program to the last known good version and analyze the differences.
   • CIgnore the change because the process is running normally.
   • DRevert the PLC to the last known good program immediately.
   Reveal Solution Discussion Select an answer first