An analyst is reviewing a series of alerts from an ICS network. The alerts show: (1) a known malicious IP communicating with a historian, (2) an unusual login to a PLC from a workstation outside the control room, and (3) a spike in Modbus traffic to a pump controller. The analyst must decide whether to escalate to incident response. What is the most appropriate decision?

Escalate only if the malicious IP is confirmed by a second source

Do not escalate because the alerts are not on the same asset

Do not escalate because each alert could be a false positive

Escalate because the combination of indicators suggests a coordinated attack

What is the key characteristic of a threat intelligence report tailored for management?

It focuses on business risk and recommended investments

It includes raw packet captures

It provides step-by-step incident response procedures

An ICS security team is implementing a threat intelligence lifecycle. During the 'direction' phase, they set a requirement to identify threats to their specific PLC models. During 'collection', they gather data from multiple sources, including vendor advisories and ISAC feeds. During 'processing', they normalize the data. During 'analysis', they correlate the data with their asset inventory. However, they are now struggling with 'dissemination' because the raw analysis is too technical for plant operators. What is the most appropriate action?

Send the full technical analysis to all stakeholders to ensure transparency.

Ask operators to attend a training session on reading technical threat reports.

Stop dissemination and focus on collecting more data to improve the analysis.

Create tailored reports for different audiences, such as operator bulletins and management summaries.

GIAC Response and Industrial Defense

Domain 2Objective 3

Threat Intelligence in an ICS Environment GRID Practice Questions (Page 2)

Part of the ICS Incident Management and Intelligence domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 6–10

6expert · hard
An analyst is reviewing a series of alerts from an ICS network. The alerts show: (1) a known malicious IP communicating with a historian, (2) an unusual login to a PLC from a workstation outside the control room, and (3) a spike in Modbus traffic to a pump controller. The analyst must decide whether to escalate to incident response. What is the most appropriate decision?
Select an answer first
7foundation · easy
Which threat actor type is most likely to be motivated by espionage to steal intellectual property from an ICS environment?
Select an answer first
8foundation · easy
What is the key characteristic of a threat intelligence report tailored for management?
Select an answer first
9expert · hard
An ICS security team is implementing a threat intelligence lifecycle. During the 'direction' phase, they set a requirement to identify threats to their specific PLC models. During 'collection', they gather data from multiple sources, including vendor advisories and ISAC feeds. During 'processing', they normalize the data. During 'analysis', they correlate the data with their asset inventory. However, they are now struggling with 'dissemination' because the raw analysis is too technical for plant operators. What is the most appropriate action?
Select an answer first
10foundation · easy
Which of the following is a common mechanism for sharing threat intelligence within the ICS community?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.

Threat Intelligence in an ICS Environment GRID Practice Questions (Page 2)

Questions 6–10

Which threat actor type is most likely to be motivated by espionage to steal intellectual property from an ICS environment?

What is the key characteristic of a threat intelligence report tailored for management?

Which of the following is a common mechanism for sharing threat intelligence within the ICS community?

Keep studying — ICS Incident Management and Intelligence