GIAC Response and Industrial Defense (GRID) Practice Tests and PDFs

An ICS environment has experienced a ransomware attack affecting several critical systems. What should be the first step in the incident response process? Response: to identify the extent of the attack

Threat intelligence indicates that a known cyber espionage group has been targeting your ICS environment with sophisticated phishing campaigns. How should your organization respond to this intelligence? Response: monitor for signs of suspicious email activity

A manufacturing plant that relies on ICS systems for its production line receives an alert indicating that unauthorized access was attempted on one of its programmable logic controllers (PLCs). What should be the first steps in handling this situation using active defense principles? Response: network, and enhance access controls to prevent further attempts

During a threat hunting exercise, you identify suspicious communication between a third-party vendor system and one of your ICS control servers. What actions should you take to investigate this further? Response: legitimacy of the traffic, and temporarily disable communication until the issue is resolved

Which of the following best describes an indicator of compromise (IOC) in threat hunting? Response:

How can centralized logging improve monitoring in ICS environments? Response: anomalies

You are responsible for implementing active defense mechanisms in a critical infrastructure ICS environment. After reviewing traffic logs, you identify repeated attempts to access an ICS network segment from an external source. How should you proceed with mitigating this threat? Response: additional network segmentation to isolate critical systems

In ICS environments, what is the primary advantage of using anomaly-based detection systems? Response:

Why is asset visibility crucial in an ICS environment? Response:

What is a common challenge in performing digital forensics in an ICS environment? Response: expertise