How should assets be prioritized in an ICS risk assessment?

By alphabetical order of their hostnames

By the order they were added to the inventory

By the number of open ports on each asset

By ranking them based on their criticality and the likelihood of a threat exploiting them

An electric utility has a large OT network with many remote substations. The security team needs to maintain asset awareness but has limited bandwidth to each substation. Which approach is most effective?

Use Shodan to monitor the substations' public IPs

Run active scans from the central location across the WAN links

Deploy passive monitoring agents at each substation that send summaries to a central server

Rely on manual inspections during quarterly maintenance visits

Why might safety constraints limit the use of active scanning for asset discovery in an ICS?

Active scanning requires physical access to every device, which is not always possible

Active scanning is too slow to be used in a safety-critical environment

Active scanning could interfere with the operation of safety-critical control systems, potentially causing unsafe conditions

Active scanning is illegal in all industrial environments

A water utility has a network with a mix of modern IP-based PLCs and legacy serial RTUs. The team wants to discover all assets but has a strict policy against any active scanning that could disrupt operations. Which combination of techniques is most appropriate?

Use a vulnerability scanner on the IP network and a serial tap on the serial network

Use Shodan to find both IP and serial devices

Use Nmap on the IP network and manual inspection on the serial network

Use passive monitoring on the IP network and a serial tap on the serial network

GIAC Response and Industrial Defense

Domain 1Objective 4

Visibility and Asset Awareness in an ICS Environment GRID Practice Questions (Page 3)

Part of the ICS Security Operations domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 7–11 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 11–15

11foundation · easy
How should assets be prioritized in an ICS risk assessment?
Select an answer first
12application · medium
An electric utility has a large OT network with many remote substations. The security team needs to maintain asset awareness but has limited bandwidth to each substation. Which approach is most effective?
Select an answer first
13foundation · easy
Why might safety constraints limit the use of active scanning for asset discovery in an ICS?
Select an answer first
14expert · hard
A water utility has a network with a mix of modern IP-based PLCs and legacy serial RTUs. The team wants to discover all assets but has a strict policy against any active scanning that could disrupt operations. Which combination of techniques is most appropriate?
Select an answer first
15foundation · easy
Which of the following tools is commonly used for active network scanning to discover hosts and open ports in an ICS environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.