Threat Intelligence in an ICS Environment GRID Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An ICS security team is considering implementing a new threat intelligence feed that provides a high volume of indicators, including many that are not relevant to their environment. The team is concerned about the operational impact on their small SOC. What is the most important consideration before integrating this feed?

   • AThe feed will definitely improve detection because more indicators always mean better security.
   • BThe feed may generate a high number of false positives that could desensitize analysts and obscure real threats.
   • CThe feed should be integrated directly into the PLC control logic to block malicious commands.
   • DThe feed should be ignored because all threat intelligence is unreliable.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst is correlating threat intelligence with network logs and finds that a known malicious IP address has been communicating with a PLC on the control network. However, the communication pattern matches normal engineering activity. What is the most appropriate analytical conclusion?

   • AThe communication is benign because the IP is in the IOC list
   • BThe PLC is definitely compromised and should be isolated immediately
   • CThe threat intelligence is unreliable and should be discarded
   • DThe IP address may be a false positive; further investigation is needed before declaring a compromise
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An ICS organization wants to integrate threat intelligence into its security operations. They have a SIEM and an IDS. They receive a feed of indicators from an ISAC. What is the most effective way to use this feed?

   • AImport the indicators into the SIEM and IDS as detection rules, but also use the intelligence to enrich alerts and guide incident response.
   • BShare the indicators with the IT team but not the ICS team to avoid false positives.
   • CStore the indicators in a spreadsheet for manual review by analysts.
   • DOnly import the indicators into the IDS to avoid overloading the SIEM.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An incident responder is analyzing a cyber intrusion at a power plant. The attacker used a spear-phishing email to gain initial access, then moved laterally using legitimate remote administration tools, and finally manipulated the HMI to cause a brief outage. Which threat actor profile best matches this behavior?

   • AA hacktivist group seeking media attention
   • BA script kiddie using publicly available exploit tools
   • CA disgruntled insider with physical access
   • DA nation-state APT group with a focus on critical infrastructure
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A natural gas pipeline operator is evaluating threat intelligence sources to improve their situational awareness. They have limited staff and need timely, actionable information about threats specific to pipeline control systems. Which source should they prioritize?

   • AA general IT security vendor's blog
   • BThe Energy ISAC (E-ISAC)
   • CA national news outlet's technology section
   • DA social media account of a security researcher
   Reveal Solution Discussion Select an answer first