Threat Intelligence in an ICS Environment GRID Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security analyst is tuning an IDS for a power utility's control network. They receive a threat intelligence feed with a list of IP addresses and domain names associated with a recent campaign. The analyst notices that some of the IPs are used by a legitimate remote vendor for maintenance. What is the best way to handle this situation?

   • ADisable the IDS alerts for all IPs in the feed
   • BIgnore the feed entirely because it contains false positives
   • CCreate an allowlist for the vendor's IPs and continue to monitor for other indicators from the feed
   • DBlock all the IPs from the feed immediately to prevent the campaign
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During the direction phase of the threat intelligence lifecycle, an ICS security manager defines the intelligence requirements for the next quarter. Which action best exemplifies this phase?

   • APrioritizing intelligence needs based on the assets and threats most relevant to the organization
   • BDistributing a finished report to plant managers
   • CCorrelating indicators to identify a new attack campaign
   • DCollecting raw data from open-source feeds and vendor advisories
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During the processing phase of the threat intelligence lifecycle, an analyst receives raw data from multiple sources, including vendor advisories and ISAC alerts. What is the primary goal of this phase?

   • ADisseminate the intelligence to relevant stakeholders
   • BCorrelate indicators to identify attack patterns
   • CConvert raw data into a structured, usable format for analysis
   • DDefine intelligence requirements and priorities
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which analytical method is used to correlate seemingly unrelated indicators to identify a broader attack campaign?

   • ALog aggregation
   • BPort scanning
   • CHash matching
   • DDiamond Model analysis
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which type of indicator is most likely to detect an attacker who is using legitimate credentials to access an ICS workstation?

   • AA hash of a malicious file
   • BA network signature for a known exploit
   • CA behavioral anomaly such as unusual login times
   • DA known command-and-control domain
   Reveal Solution Discussion Select an answer first