What is the primary goal of threat intelligence analysis in an ICS environment?

To produce actionable insights that inform defensive decisions

To collect as much data as possible

To automate all security controls

An ICS security manager must produce a threat intelligence report for the board of directors after a near-miss incident. The board is concerned about the financial and reputational impact. Which report structure best meets the board's needs?

Detailed technical analysis with IOCs and TTPs

A comparison of the incident to other companies' incidents without recommendations

Executive summary with business impact, key findings, and recommended investments

A timeline of the incident with every alert and log entry

Which of the following is an example of a host-based indicator of compromise (IOC) in an ICS environment?

An unexpected registry key on a historian server

A suspicious network connection to a known malicious IP

A new firewall rule allowing outbound traffic

An unusual pattern of Modbus traffic

An ICS security team is evaluating a threat intelligence feed that provides a large number of IOCs, but many are not relevant to their OT environment. They are concerned about the operational impact of false positives. What is the most effective way to use this feed?

Filter the feed to only include IOCs that match the protocols and assets in their environment

Integrate the feed directly into the IDS without filtering to maximize coverage

Use the feed only for manual analysis and not for automated detection

Block all IOCs from the feed at the network perimeter

Which of the following best describes the typical motivation of a hacktivist targeting an ICS environment?

Financial gain through ransomware

GIAC Response and Industrial Defense

Domain 2Objective 3

Threat Intelligence in an ICS Environment GRID Practice Questions (Page 7)

Part of the ICS Incident Management and Intelligence domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 31–35

31foundation · easy
What is the primary goal of threat intelligence analysis in an ICS environment?
Select an answer first
32expert · hard
An ICS security manager must produce a threat intelligence report for the board of directors after a near-miss incident. The board is concerned about the financial and reputational impact. Which report structure best meets the board's needs?
Select an answer first
33foundation · easy
Which of the following is an example of a host-based indicator of compromise (IOC) in an ICS environment?
Select an answer first
34expert · hard
An ICS security team is evaluating a threat intelligence feed that provides a large number of IOCs, but many are not relevant to their OT environment. They are concerned about the operational impact of false positives. What is the most effective way to use this feed?
Select an answer first
35foundation · easy
Which of the following best describes the typical motivation of a hacktivist targeting an ICS environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.