Threat Intelligence in an ICS Environment GRID Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why can incomplete threat intelligence data be particularly problematic in an ICS environment?

   • AIt makes the threat intelligence lifecycle impossible
   • BIt always causes the ICS to shut down
   • CIt may lead to incorrect assumptions about the safety impact of an attack
   • DIt prevents all communication with vendors
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An ICS organization has a SIEM that is receiving logs from the IT network but not from the OT network due to segmentation. They want to use threat intelligence to detect threats in the OT network. What is the most important first step?

   • AManually review OT logs on an ad hoc basis when an IT alert occurs.
   • BShare the threat intelligence with the IT team only, since the OT network is segmented.
   • CEstablish a method to collect and forward OT network logs and asset data to the SIEM, while respecting the safety and availability of the OT environment.
   • DDeploy an IDS in the OT network that uses the threat intelligence feed.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company in the electric utility sector wants to share information about a new phishing campaign with other utilities. They are concerned about legal liability and want to ensure the information is protected. What is the best mechanism?

   • AShare through the sector ISAC using the Traffic Light Protocol (TLP) to control distribution.
   • BWait for a government advisory to be published.
   • CPost the details on a public mailing list to reach the widest audience.
   • DShare only with direct competitors under a non-disclosure agreement.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An ICS security team is implementing a threat intelligence program. They have collected a large amount of data from various sources, but they are struggling to turn it into actionable intelligence. They have a SIEM but it is not yet configured to use the data. According to the threat intelligence lifecycle, what is the most critical step they should focus on next?

   • AFeedback, to ask stakeholders if they liked the data.
   • BAnalysis, to correlate and interpret the collected data to produce actionable insights.
   • CDissemination, to share the raw data with other teams.
   • DCollection, because they need even more data to be effective.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In the threat intelligence lifecycle, which step involves converting raw data into a format that can be analyzed, such as normalizing logs and translating foreign-language reports?

   • ADissemination
   • BCollection
   • CAnalysis
   • DProcessing
   Reveal Solution Discussion Select an answer first