After completing a threat hunt that identified a suspicious Modbus command sequence, an analyst needs to document the findings and recommend mitigations. What should be included in the final report?

Only the confirmed indicators of compromise and their threat intelligence sources.

A detailed list of all network traffic captured during the hunt.

A recommendation to immediately disconnect all affected devices from the network.

The hypothesis, methodology, findings, evidence, and recommended mitigations.

A hunt team has completed an intel-driven hunt for a specific ICS threat group. They found no indicators of compromise, but the hunt generated a large amount of data and consumed significant resources. What is the most important outcome to document in the final report?

The conclusion that no compromise was found and the hunt is closed

The total cost of the hunt in terms of time and resources

The lessons learned, including what worked and what could be improved for future hunts

The list of all data sources that were searched

An analyst at a power utility is examining DNP3 traffic and notices that a specific RTU is sending unsolicited responses containing invalid CRC values. The baseline shows this RTU normally only responds to polls. The analyst also finds that the source IP address of the RTU has changed to an address outside the expected range. What is the most likely explanation and appropriate action?

The DNP3 protocol is inherently unreliable; ignore the anomaly.

An attacker is spoofing the RTU and sending crafted traffic; investigate the network path and verify the RTU's actual identity.

The RTU has a hardware fault; replace the RTU.

The RTU firmware was updated; accept the new behavior.

Which of the following is a key indicator of compromise (IOC) to look for when examining an HMI (Human-Machine Interface) workstation?

An unexpected scheduled task that runs a PowerShell script

A network connection to the historian server

The presence of a standard HMI application like Wonderware

A high CPU usage during normal operations

A security analyst is explaining threat hunting to a new team member in an ICS environment. The new member asks why threat hunting is important in ICS when they already have intrusion detection systems (IDS) in place. What is the most accurate reason to give?

Threat hunting can identify unknown threats that signature-based IDS may miss

Threat hunting is only needed because IDS generates too many false positives

Threat hunting replaces the need for IDS in ICS environments

Threat hunting is required by regulation, so it must be performed

GIAC Response and Industrial Defense

Domain 2Objective 2

Threat Hunting and Analysis in an ICS Environment GRID Practice Questions (Page 9)

Part of the ICS Incident Management and Intelligence domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

Questions 41–45

41application · medium
After completing a threat hunt that identified a suspicious Modbus command sequence, an analyst needs to document the findings and recommend mitigations. What should be included in the final report?
Select an answer first
42expert · hard
A hunt team has completed an intel-driven hunt for a specific ICS threat group. They found no indicators of compromise, but the hunt generated a large amount of data and consumed significant resources. What is the most important outcome to document in the final report?
Select an answer first
43expert · hard
An analyst at a power utility is examining DNP3 traffic and notices that a specific RTU is sending unsolicited responses containing invalid CRC values. The baseline shows this RTU normally only responds to polls. The analyst also finds that the source IP address of the RTU has changed to an address outside the expected range. What is the most likely explanation and appropriate action?
Select an answer first
44foundation · easy
Which of the following is a key indicator of compromise (IOC) to look for when examining an HMI (Human-Machine Interface) workstation?
Select an answer first
45application · medium
A security analyst is explaining threat hunting to a new team member in an ICS environment. The new member asks why threat hunting is important in ICS when they already have intrusion detection systems (IDS) in place. What is the most accurate reason to give?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.