A security manager at a food processing plant wants to implement threat hunting but is concerned about disrupting production. The plant's OT network is highly available and changes are tightly controlled. What is the most important consideration when planning a hunt in this environment?

Ensure that hunting activities are passive and do not interfere with control system operations.

Run active scans on all PLCs to identify vulnerabilities quickly.

Focus only on IT systems because OT systems are isolated.

Use the same hunting tools and techniques as in the corporate IT network.

A team is establishing a baseline for a chemical plant's OPC UA traffic. They have collected data for one month, but the plant is planning to add a new production line that will significantly increase traffic. How should the team adjust their baseline strategy?

Wait until the new line is operational and then re-baseline over a representative period

Use vendor documentation to predict the new traffic and update the baseline

Use the current baseline and manually account for the new line's traffic in anomaly detection

Keep the current baseline and treat all increased traffic as anomalous

A team is planning a hunt based on a new threat intelligence report that describes a campaign targeting HVAC systems in commercial buildings. The team's ICS environment includes building automation systems. Which hunting methodology is most appropriate?

Baseline-driven hunting to identify any deviations in HVAC behavior

Intel-driven hunting using the IOCs and TTPs from the report

Hypothesis-driven hunting based on the assumption that the HVAC systems are compromised

A combination of all three methodologies to cover all possibilities

A water treatment facility has experienced several false positives from its ICS intrusion detection system, causing operators to ignore alerts. The security team wants to implement a proactive threat hunting program that reduces alert fatigue while improving detection of subtle attacks. Which approach best aligns with ICS threat hunting principles?

Deploy additional network taps and increase the sensitivity of IDS rules to capture more traffic.

Schedule weekly vulnerability scans of all PLCs and RTUs to identify missing patches.

Establish a baseline of normal process behavior and hunt for deviations that match known attack patterns.

Replace the IDS with an endpoint detection and response tool on all HMIs and engineering workstations.

GIAC Response and Industrial Defense

Domain 2Objective 2

Threat Hunting and Analysis in an ICS Environment GRID Practice Questions (Page 6)

Part of the ICS Incident Management and Intelligence domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 26–30

26application · medium
A security manager at a food processing plant wants to implement threat hunting but is concerned about disrupting production. The plant's OT network is highly available and changes are tightly controlled. What is the most important consideration when planning a hunt in this environment?
Select an answer first
27expert · hard
A team is establishing a baseline for a chemical plant's OPC UA traffic. They have collected data for one month, but the plant is planning to add a new production line that will significantly increase traffic. How should the team adjust their baseline strategy?
Select an answer first
28application · medium
A team is planning a hunt based on a new threat intelligence report that describes a campaign targeting HVAC systems in commercial buildings. The team's ICS environment includes building automation systems. Which hunting methodology is most appropriate?
Select an answer first
29foundation · easy
An ICS threat hunter wants to identify unusual behavior by comparing current network traffic to a historical pattern of normal operations. Which hunting methodology is being applied?
Select an answer first
30application · medium
A water treatment facility has experienced several false positives from its ICS intrusion detection system, causing operators to ignore alerts. The security team wants to implement a proactive threat hunting program that reduces alert fatigue while improving detection of subtle attacks. Which approach best aligns with ICS threat hunting principles?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.

Threat Hunting and Analysis in an ICS Environment GRID Practice Questions (Page 6)

Questions 26–30

A security manager at a food processing plant wants to implement threat hunting but is concerned about disrupting production. The plant's OT network is highly available and changes are tightly controlled. What is the most important consideration when planning a hunt in this environment?

A team is establishing a baseline for a chemical plant's OPC UA traffic. They have collected data for one month, but the plant is planning to add a new production line that will significantly increase traffic. How should the team adjust their baseline strategy?

A team is planning a hunt based on a new threat intelligence report that describes a campaign targeting HVAC systems in commercial buildings. The team's ICS environment includes building automation systems. Which hunting methodology is most appropriate?

An ICS threat hunter wants to identify unusual behavior by comparing current network traffic to a historical pattern of normal operations. Which hunting methodology is being applied?

Keep studying — ICS Incident Management and Intelligence