Which of the following best describes how threat intelligence can be used during incident response in an ICS environment?

To identify the attacker's identity and physical location

To prioritize response actions based on known TTPs and indicators

To replace the need for forensic analysis

To automatically recover affected ICS devices

An ICS security analyst must write a threat intelligence report for two audiences: the plant operators and the executive leadership. What is the best approach to tailor the report?

Send the same detailed technical report to both audiences

Create two versions: one with technical indicators for operators and one with business impact for executives

Provide only a summary to operators and full technical details to executives

Focus on strategic intelligence for operators and tactical for executives

An ICS SOC is tuning its SIEM to detect a known threat group that targets engineering workstations. The group is known to use specific malware hashes and command-and-control domains. However, the SOC also wants to detect the group's behavior when it uses new malware variants. Which type of indicator should the SOC prioritize adding to the SIEM?

Command-and-control domain names from past campaigns.

Static IP addresses of the C2 servers.

File hashes of the known malware variants.

Behavioral indicators, such as unusual RDP connections from engineering workstations to external IPs.

A small ICS operator wants to participate in threat intelligence sharing but lacks the resources to maintain a dedicated sharing platform. They are concerned about legal liability when sharing incident data. Which approach best addresses their constraints?

Wait for a major incident before sharing to avoid liability

Create a private sharing portal with peer companies

Share only anonymized data on a public forum

Join a sector ISAC and share through its established platform with legal protections

An ICS security team is integrating threat intelligence into their SIEM. They have a limited number of correlation rules and want to maximize detection of ICS-specific attacks while minimizing false positives. Which approach is most effective?

Create a single rule that alerts on any IOC from the feed

Focus only on host-based indicators to avoid network noise

Use only the most recent IOCs and ignore older ones

Prioritize correlation rules that combine network indicators with behavioral anomalies specific to ICS protocols

GIAC Response and Industrial Defense

Domain 2Objective 3

Threat Intelligence in an ICS Environment GRID Practice Questions (Page 9)

Part of the ICS Incident Management and Intelligence domain, which makes up ~46% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~23–37 in this domain), expect 8–12 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

10concepts

Questions 41–45

41foundation · easy
Which of the following best describes how threat intelligence can be used during incident response in an ICS environment?
Select an answer first
42application · medium
An ICS security analyst must write a threat intelligence report for two audiences: the plant operators and the executive leadership. What is the best approach to tailor the report?
Select an answer first
43application · medium
An ICS SOC is tuning its SIEM to detect a known threat group that targets engineering workstations. The group is known to use specific malware hashes and command-and-control domains. However, the SOC also wants to detect the group's behavior when it uses new malware variants. Which type of indicator should the SOC prioritize adding to the SIEM?
Select an answer first
44expert · hard
A small ICS operator wants to participate in threat intelligence sharing but lacks the resources to maintain a dedicated sharing platform. They are concerned about legal liability when sharing incident data. Which approach best addresses their constraints?
Select an answer first
45expert · hard
An ICS security team is integrating threat intelligence into their SIEM. They have a limited number of correlation rules and want to maximize detection of ICS-specific attacks while minimizing false positives. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.