Visibility and Asset Awareness in an ICS Environment GRID Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which process is essential for maintaining ongoing asset awareness in an ICS environment?

   • ADeleting the inventory after each change to avoid outdated information
   • BPerforming a one-time asset discovery and never updating the inventory
   • CContinuously monitoring the network and updating the asset inventory whenever changes are detected
   • DRelying solely on vendor documentation without any network monitoring
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A pharmaceutical plant's OT team has a spreadsheet of assets that is missing several field devices added during a recent line expansion. The security manager wants to prioritize which missing assets to identify first. Which approach best aligns with the goal of building a complete and accurate inventory?

   • ACross-reference the spreadsheet against the engineering drawings and the change-management records from the expansion project.
   • BWait for the next scheduled maintenance window to manually walk the plant floor and document every device.
   • CUse the vendor's default configuration files for all PLC models to infer what devices should be present.
   • DAsk the IT team to export the Active Directory computer list and treat it as the OT asset inventory.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A manufacturing plant has a mix of legacy serial devices and modern Ethernet-based controllers. The security team needs to create a complete asset inventory but is concerned that active scanning could disrupt the legacy serial devices. They also need to identify the make and model of each device. Which approach best balances safety and completeness?

   • AUse only passive monitoring and assume all devices are Ethernet-based.
   • BUse passive monitoring to identify Ethernet devices and correlate with serial device documentation and physical walk-downs.
   • CUse active scanning with a protocol-specific scanner that supports both serial and Ethernet devices.
   • DUse active scanning on the Ethernet segment and passive monitoring on the serial segment.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a limitation of active scanning when used for asset discovery in an ICS network?

   • AActive scanning can cause unintended disruption to legacy devices that are not designed to handle unexpected traffic
   • BActive scanning provides less detailed information than passive monitoring
   • CActive scanning is only effective on wireless networks, not wired networks
   • DActive scanning cannot identify the IP address of any device on the network
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An engineer needs to discover assets on a substation network that uses a proprietary protocol not recognized by standard Nmap service probes. The network contains relays that are sensitive to malformed packets. Which tool and approach is most appropriate?

   • ARun a full UDP port scan with Nmap to detect any open UDP ports used by the proprietary protocol.
   • BUse Shodan to search for the substation's public IP and identify the devices from the banner information.
   • CUse an industrial protocol scanner that supports the proprietary protocol and performs read-only queries.
   • DUse Nmap with the -sV flag to probe every TCP port and identify the proprietary service by its banner.
   Reveal Solution Discussion Select an answer first