Visibility and Asset Awareness in an ICS Environment GRID Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A pipeline operator needs to identify all devices on a remote site's OT network. The network uses a proprietary protocol that is not well-documented. Which technique is most likely to succeed?

   • ACapture network traffic and analyze it with a protocol analyzer that supports the proprietary protocol
   • BAsk the vendor for a list of devices on the network
   • CUse Nmap to scan for open ports and guess the protocol
   • DUse Shodan to search for the remote site's IP address
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A power utility is prioritizing its OT assets for security monitoring. The team must decide which assets to monitor most closely. Which asset should be considered the highest priority?

   • AA safety-instrumented system (SIS) that can shut down the plant
   • BA workstation used for engineering configuration
   • CA historian server that stores process data
   • DA PLC that controls a non-critical cooling fan
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a unique challenge to asset visibility in an ICS environment?

   • ASafety constraints are irrelevant to asset discovery
   • BLegacy systems that use proprietary protocols and may not respond to standard discovery tools
   • CICS networks are typically simple and have few devices, making discovery easy
   • DAll ICS devices are modern and fully documented by vendors
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A chemical plant has a mix of modern and legacy ICS devices. The security team wants to maintain continuous asset awareness but cannot install agents on legacy devices. Which strategy is most effective?

   • ASchedule manual audits of each device every month
   • BInstall software agents on all devices that support them
   • CDeploy passive network monitoring at key aggregation points
   • DUse active scanning with a low frequency to avoid disruption
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A utility has an asset inventory that is updated manually every quarter. They have noticed that new devices appear on the network between updates, and some devices are decommissioned without notice. The security team wants to maintain continuous asset awareness without overburdening the OT staff. Which process should they implement?

   • ARun a weekly active scan of the OT network to detect changes.
   • BUse the change-management system as the sole source of truth and ignore network-level detection.
   • CRequire OT staff to manually update the inventory after every shift.
   • DDeploy a passive network monitoring solution that continuously detects new devices and alerts on changes, integrated with the inventory system.
   Reveal Solution Discussion Select an answer first