A food and beverage manufacturer is building an ICS asset inventory. The team has access to network diagrams, a CMDB, and passive traffic captures. Which approach will produce the most reliable inventory?

Use only the CMDB because it is maintained by IT

Combine the CMDB with passive traffic captures and reconcile differences

Use only passive traffic captures because they show actual devices

Use only the network diagrams because they are drawn by engineers

A water utility has a network segment with legacy PLCs that are sensitive to active scanning. The security team needs to discover all assets, including devices that may not be actively communicating. Which tool and approach is most appropriate?

Use a passive monitoring solution that captures traffic over a long period to identify devices that communicate infrequently.

Use Shodan to search for the utility's public IP range.

Use a protocol-specific scanner that sends read-only queries to all possible addresses.

Use Nmap with a slow timing template to minimize the risk to legacy PLCs.

A manufacturing plant has a network with many devices that use a proprietary protocol. The security team wants to discover assets but has no documentation for the protocol. Which approach is most effective?

Use Nmap to scan for open ports and guess the protocol

Use Shodan to search for the plant's public IP

Ask the vendor for a list of devices

Use a passive protocol analyzer that can learn the protocol by observing traffic

A manufacturing company wants to improve its OT asset awareness by combining multiple data sources. The OT network is flat and uses a mix of Ethernet/IP and legacy serial devices. Which combination of data sources would provide the most complete and current asset picture?

Only network traffic captures, because they show every device that communicates.

Only the CMDB, because it is the authoritative source for all IT and OT assets.

Vendor documentation only, because it lists all supported devices and their default configurations.

Network traffic captures from a SPAN port, the CMDB, and vendor documentation for serial devices.

GIAC Response and Industrial Defense

Domain 1Objective 4

Visibility and Asset Awareness in an ICS Environment GRID Practice Questions (Page 2)

Part of the ICS Security Operations domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 7–11 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 6–10

6application · medium
A food and beverage manufacturer is building an ICS asset inventory. The team has access to network diagrams, a CMDB, and passive traffic captures. Which approach will produce the most reliable inventory?
Select an answer first
7expert · hard
A water utility has a network segment with legacy PLCs that are sensitive to active scanning. The security team needs to discover all assets, including devices that may not be actively communicating. Which tool and approach is most appropriate?
Select an answer first
8expert · hard
A manufacturing plant has a network with many devices that use a proprietary protocol. The security team wants to discover assets but has no documentation for the protocol. Which approach is most effective?
Select an answer first
9foundation · easy
Which of the following is an example of an industrial protocol-specific scanner used to discover assets in an ICS?
Select an answer first
10application · medium
A manufacturing company wants to improve its OT asset awareness by combining multiple data sources. The OT network is flat and uses a mix of Ethernet/IP and legacy serial devices. Which combination of data sources would provide the most complete and current asset picture?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.