Which type of threat intelligence source is most likely to provide early warnings about emerging ICS-specific attack techniques?

A government alert such as a CISA advisory

A vendor's product documentation

An internal asset inventory list

Which of the following is a common limitation of threat intelligence in an ICS environment?

Threat intelligence is too expensive for most ICS organizations

Threat intelligence is often based on IT systems and may not account for ICS-specific protocols and behaviors

Threat intelligence is only useful for IT networks

Threat intelligence always contains false positives

Which of the following is an example of a sector-specific threat intelligence source for ICS environments?

A vendor security advisory for a specific PLC model

A public malware analysis report from a security vendor

The Department of Homeland Security's CISA alerts

The Electricity Information Sharing and Analysis Center (E-ISAC)

A small ICS team wants to stay informed about threats but cannot afford a commercial threat intelligence service. They have limited time to monitor multiple sources. Which combination of free sources would be most effective?

Wait for news reports of major ICS incidents.

Rely only on the vendor's support portal for security patches.

Monitor social media and hacker forums for any mention of ICS.

Subscribe to CISA alerts, sector ISAC feeds, and vendor security advisories for their specific equipment.

GIAC Response and Industrial Defense

Domain 2Objective 3

Threat Intelligence in an ICS Environment GRID Practice Questions (Page 6)

Part of the ICS Incident Management and Intelligence domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 26–30

26foundation · easy
Which type of threat intelligence source is most likely to provide early warnings about emerging ICS-specific attack techniques?
Select an answer first
27foundation · easy
Which step of the threat intelligence lifecycle involves defining the intelligence requirements for an ICS environment, such as identifying which assets and threats are most important?
Select an answer first
28foundation · easy
Which of the following is a common limitation of threat intelligence in an ICS environment?
Select an answer first
29foundation · easy
Which of the following is an example of a sector-specific threat intelligence source for ICS environments?
Select an answer first
30application · medium
A small ICS team wants to stay informed about threats but cannot afford a commercial threat intelligence service. They have limited time to monitor multiple sources. Which combination of free sources would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.