A refinery is prioritizing assets for a new security monitoring program. The team must decide which asset to monitor first. Which asset has the highest criticality?

A safety shutdown system that can trigger an emergency plant stop

A historian that logs process data for compliance

A PLC that controls a water treatment unit

A DCS that manages the main distillation process

A utility has a large OT network with many remote sites connected via low-bandwidth links. The security team needs to maintain asset awareness but cannot afford to deploy monitoring agents at every site. Which approach is most effective?

Deploy agents at every site, even if it exceeds the budget

Use only the CMDB to track assets

Deploy passive monitoring at a few central aggregation points and use NetFlow data from routers

Run active scans from the central location across the WAN links

A nuclear facility has a highly segmented OT network with legacy systems that cannot tolerate any active scanning. The security team needs to build an asset inventory but also needs to identify the vendor and firmware version of each device. Which approach best meets both requirements?

Run a gentle Nmap scan with a long delay between probes to avoid disrupting the legacy systems.

Use a protocol-specific scanner that sends read-only queries to identify vendor and firmware.

Access each device's web interface to read the firmware version.

Use passive monitoring to capture traffic and correlate it with vendor documentation and procurement records.

A pharmaceutical company is updating its asset inventory. The team has network traffic captures, a CMDB, and vendor documentation. Which data source is most useful for identifying the firmware version of a PLC?

Direct query to the PLC using its engineering protocol

When assessing the criticality of an ICS asset, which factor is most important to consider?

The potential impact of the asset's failure or compromise on operational safety and production continuity

The vendor's marketing materials describing the asset's features

The number of network ports the asset has

The age of the asset and its original purchase price

GIAC Response and Industrial Defense

Domain 1Objective 4

Visibility and Asset Awareness in an ICS Environment GRID Practice Questions (Page 9)

Part of the ICS Security Operations domain, which makes up ~54% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~27–43 in this domain), expect 7–11 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

7concepts

Questions 41–45

41application · medium
A refinery is prioritizing assets for a new security monitoring program. The team must decide which asset to monitor first. Which asset has the highest criticality?
Select an answer first
42expert · hard
A utility has a large OT network with many remote sites connected via low-bandwidth links. The security team needs to maintain asset awareness but cannot afford to deploy monitoring agents at every site. Which approach is most effective?
Select an answer first
43expert · hard
A nuclear facility has a highly segmented OT network with legacy systems that cannot tolerate any active scanning. The security team needs to build an asset inventory but also needs to identify the vendor and firmware version of each device. Which approach best meets both requirements?
Select an answer first
44application · medium
A pharmaceutical company is updating its asset inventory. The team has network traffic captures, a CMDB, and vendor documentation. Which data source is most useful for identifying the firmware version of a PLC?
Select an answer first
45foundation · easy
When assessing the criticality of an ICS asset, which factor is most important to consider?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GRID

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GRID” is a trademark of its owner, used for identification only.