An analyst is correlating threat intelligence with ICS network logs. They see a series of Modbus TCP read requests from an engineering workstation to a PLC, all from the same source IP, occurring at regular intervals. The requests are for valid register addresses and the values returned are within normal ranges. The workstation is not scheduled to be polling that PLC. What is the most appropriate conclusion?

This is a network signature of a specific malware and should be blocked.

This is a known indicator of the threat group and should trigger an immediate incident response.

This is likely a benign but unauthorized behavior that should be investigated further, possibly indicating a misconfiguration or an insider.

This is definitely a false positive because the requests are valid Modbus reads.

An ICS security team wants to integrate threat intelligence into their SIEM to reduce alert fatigue. They have a list of IOCs from a trusted ISAC. Which approach best leverages the SIEM for this purpose?

Disable the SIEM alerts for known IOCs to avoid noise

Block all IPs from the IOC list at the firewall

Create correlation rules that alert only when multiple IOCs are observed together

Import all IOCs as individual alerts and tune the severity to low

An ICS security manager must brief the plant operations director on the risk of a specific threat group targeting their industry. The director is not technical and needs to understand the business impact and likelihood. Which type of threat intelligence should the manager use for this briefing?

A raw feed of all recent alerts from the SIEM that correlate with the threat group's known indicators.

Tactical threat intelligence, detailing the specific TTPs and tools the group uses.

Operational threat intelligence, listing the specific IP addresses and hashes observed in recent campaigns.

Strategic threat intelligence, summarizing the threat group's motivations, targets, and potential business impact.

A regional water utility has a small ICS security team and limited budget. They need to stay informed about threats to their specific sector (water/wastewater) without overwhelming their analysts. Which approach best meets their needs?

Monitor public social media and dark web forums for mentions of their utility's name.

Rely solely on vendor advisories from their PLC and SCADA vendors.

Purchase a commercial threat intelligence platform that aggregates global threat data from multiple sources.

Subscribe to the WaterISAC threat feed and participate in its sector-specific webinars and alerts.

What is the primary purpose of an Information Sharing and Analysis Center (ISAC) in the ICS community?

To provide a platform for sharing threat intelligence among organizations within a specific sector

To provide legal defense for member organizations

To sell threat intelligence to government agencies

To replace the need for internal security monitoring

GIAC Response and Industrial Defense

Domain 2Objective 3

Threat Intelligence in an ICS Environment GRID Practice Questions (Page 8)

Part of the ICS Incident Management and Intelligence domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 36–40

36expert · hard
An analyst is correlating threat intelligence with ICS network logs. They see a series of Modbus TCP read requests from an engineering workstation to a PLC, all from the same source IP, occurring at regular intervals. The requests are for valid register addresses and the values returned are within normal ranges. The workstation is not scheduled to be polling that PLC. What is the most appropriate conclusion?
Select an answer first
37application · medium
An ICS security team wants to integrate threat intelligence into their SIEM to reduce alert fatigue. They have a list of IOCs from a trusted ISAC. Which approach best leverages the SIEM for this purpose?
Select an answer first
38application · medium
An ICS security manager must brief the plant operations director on the risk of a specific threat group targeting their industry. The director is not technical and needs to understand the business impact and likelihood. Which type of threat intelligence should the manager use for this briefing?
Select an answer first
39application · medium
A regional water utility has a small ICS security team and limited budget. They need to stay informed about threats to their specific sector (water/wastewater) without overwhelming their analysts. Which approach best meets their needs?
Select an answer first
40foundation · easy
What is the primary purpose of an Information Sharing and Analysis Center (ISAC) in the ICS community?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.