An energy company is consolidating its OT asset inventory. The team has access to a CMDB, network traffic captures, and vendor documentation. Which combination of data sources provides the most accurate and current asset awareness?

Use vendor documentation to create a static list of all possible devices

Use only network traffic captures because they show real devices

Use only the CMDB because it is the authoritative source

Use network traffic captures to identify active devices and cross-reference with the CMDB

Which of the following asset types is commonly found in an ICS environment and should be included in an asset inventory?

Only the servers and workstations in the corporate IT network

Programmable Logic Controllers (PLCs) that control physical processes

Only devices that are directly connected to the internet

Only devices that have an IP address and can be scanned over the network

A chemical plant has a mix of legacy serial devices and modern Ethernet-based controllers. The security team needs to identify all assets but is concerned that active scanning could disrupt the legacy serial devices. Which technique should they use to gain visibility?

Passive monitoring of the network using a SPAN port or network tap.

Active scanning with a protocol-specific scanner that sends write commands to force responses.

Use a combination of DHCP logs and DNS records to identify all devices.

Active scanning with Nmap using the -A flag to enable OS and service detection.

A refinery has an asset inventory that is updated manually every month. The security team wants to implement continuous monitoring but is concerned about the impact of active scanning on the legacy DCS. Which approach should they take to maintain asset awareness?

Continue with monthly manual updates because they are sufficient for compliance.

Deploy a passive monitoring solution that continuously detects new devices and updates the inventory automatically.

Use the change-management system as the only source of truth for asset changes.

Use a scheduled active scan during maintenance windows to update the inventory.

How can network traffic data contribute to asset awareness in an ICS?

By replacing the need for any other data source for asset awareness

By automatically updating the CMDB with new asset information without any manual intervention

By providing a complete list of all software vulnerabilities in the environment

By revealing active communication patterns and identifying devices that are actually communicating on the network

GIAC Response and Industrial Defense

Domain 1Objective 4

Visibility and Asset Awareness in an ICS Environment GRID Practice Questions (Page 6)

Part of the ICS Security Operations domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 7–11 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 26–30

26application · medium
An energy company is consolidating its OT asset inventory. The team has access to a CMDB, network traffic captures, and vendor documentation. Which combination of data sources provides the most accurate and current asset awareness?
Select an answer first
27foundation · easy
Which of the following asset types is commonly found in an ICS environment and should be included in an asset inventory?
Select an answer first
28application · medium
A chemical plant has a mix of legacy serial devices and modern Ethernet-based controllers. The security team needs to identify all assets but is concerned that active scanning could disrupt the legacy serial devices. Which technique should they use to gain visibility?
Select an answer first
29expert · hard
A refinery has an asset inventory that is updated manually every month. The security team wants to implement continuous monitoring but is concerned about the impact of active scanning on the legacy DCS. Which approach should they take to maintain asset awareness?
Select an answer first
30foundation · easy
How can network traffic data contribute to asset awareness in an ICS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.