Visibility and Asset Awareness in an ICS Environment GRID Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A chemical plant has a limited budget for security monitoring. The team must choose which assets to monitor with full packet capture. Which asset should be selected?

   • AThe historian that stores batch records
   • BThe PLC that controls the packaging line
   • CThe safety system that can trigger an emergency shutdown
   • DThe DCS that controls the main reactor
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A refinery has a mix of Windows-based HMIs and legacy PLCs that communicate using a proprietary protocol. The security team wants to map the OT network but is concerned about the impact of active scanning on the legacy PLCs. Which approach best addresses the challenge?

   • AUse passive network monitoring to observe traffic and identify devices without sending packets.
   • BRun a full Nmap scan with OS detection to identify all devices and their operating systems.
   • CDisable the proprietary protocol on the PLCs temporarily to allow standard Nmap scans.
   • DUse a protocol-specific scanner that sends write commands to elicit responses from the PLCs.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A food processing plant wants to improve its OT asset awareness. The plant has a CMDB that is incomplete, and the network team has PCAP files from a recent monitoring project. The engineering team has vendor manuals for all equipment. Which data source should be used to fill the gaps in the CMDB?

   • AThe IT help desk tickets, because they record all device-related issues.
   • BThe PCAP files, because they show actual devices communicating on the network.
   • CThe CMDB itself, because it is the authoritative source and should not be questioned.
   • DThe vendor manuals, because they list all possible devices and their configurations.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a key advantage of passive monitoring over active scanning for gaining visibility into an ICS network?

   • APassive monitoring requires no network taps or port mirroring configuration
   • BPassive monitoring can identify devices without sending packets that might disrupt sensitive control traffic
   • CPassive monitoring can detect devices that are not currently communicating on the network
   • DPassive monitoring provides real-time vulnerability information for all discovered devices
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A manufacturing company has a CMDB that is incomplete and a network that has many unmanaged devices. The security team needs to prioritize which assets to add to the inventory first. Which approach is most effective?

   • AAdd all devices discovered by passive monitoring, regardless of criticality
   • BUse only the CMDB to avoid duplication
   • CWait until a full network scan is complete before adding any assets
   • DPrioritize devices that are critical to safety and production, then add others
   Reveal Solution Discussion Select an answer first