Visibility and Asset Awareness in an ICS Environment GRID Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A natural gas plant has a network with a mix of modern and legacy devices. The team wants to create a baseline of network traffic for asset discovery. Which method is most appropriate?

   • ARun a port scan with a tool like Nmap
   • BReview firewall logs for allowed connections
   • CCapture traffic using a SPAN port on the switch
   • DUse Shodan to search for the plant's external IP
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A power utility is building a risk-based asset inventory. They have identified a transformer protection relay, a weather station sensor, and a building access controller. Which asset should be assigned the highest criticality for prioritization?

   • AThe building access controller, because it controls physical security.
   • BThe transformer protection relay, because its failure could directly cause equipment damage and grid instability.
   • CThe weather station sensor, because it provides data that affects load forecasting.
   • DAll three should have equal criticality because they are all part of the OT network.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An OT security analyst needs to discover assets on a network segment that uses the Modbus TCP protocol. The segment contains a mix of PLCs and RTUs, some of which are old and sensitive to malformed packets. Which tool and approach is most appropriate?

   • AUse a Modbus-specific scanner that sends read-only queries to standard Modbus function codes.
   • BUse Nmap with the -sV flag to probe all open ports and identify the Modbus service.
   • CUse Shodan to search for Modbus devices on the internal network.
   • DUse a full TCP connect scan to enumerate all open ports on each device.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is a recommended practice for ensuring the asset inventory remains accurate over time?

   • ARelying on the memory of senior operators to know what is on the network
   • BOnly updating the inventory after a security incident occurs
   • CKeeping the inventory in a spreadsheet that is only updated once a year
   • DIntegrating the inventory with change management processes so that any approved change updates the inventory
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A water treatment facility has a mix of legacy serial-based PLCs and modern Ethernet-based HMIs. The OT network is segmented from IT, and the safety team prohibits any active traffic that could disrupt time-critical control loops. The security team needs to build an initial asset inventory without risking operational impact. Which approach should they use?

   • AQuery the IT DHCP server logs to identify all OT devices by their IP leases.
   • BRun an Nmap SYN scan across all OT subnets to map live hosts and open ports.
   • CDeploy a passive network tap on the OT switch mirror ports and analyze traffic with a protocol-aware passive sensor.
   • DUse Shodan to search for the facility's public IP range and compile the asset list from internet-exposed devices.
   Reveal Solution Discussion Select an answer first