GRID - GIAC Response and Industrial Defense Asset Discovery and Visibility Questions and Answers

Question 1

An OT security team needs to build a comprehensive asset inventory for a process control network that operates 24/7.
Which asset discovery method should be prioritized to ensure operational safety and avoid disrupting sensitive real-time processes?

Accepted Answer

Using passive network monitoring to analyze traffic from a SPAN port or network TAP.

Answer

Deploying agents on all endpoints to report system details.

Answer

Performing credentialed active network scans during a scheduled maintenance window.

Answer

Importing asset data from the engineering department's design documents and spreadsheets.

Question 2

A GRID analyst is creating an asset inventory with a focus on enabling effective vulnerability management. Which of the following asset attributes is MOST critical to collect for cross-referencing with vulnerability databases like CISA's KEV Catalog or MITRE's CVE database?

Accepted Answer

Vendor, model, and firmware version

Answer

Physical location in the plant

Answer

IP address and MAC address

Answer

Operational criticality and role

Question 3

While passively monitoring a manufacturing network, an analyst's visibility platform identifies a new MAC address communicating via CIP (Common Industrial Protocol). The device's IP address is not in the authorized asset database. What is the safest and MOST effective next step to identify this device?

Accepted Answer

Continue passive analysis of the device's traffic to identify its role, vendor, and communication patterns.

Answer

Immediately block the MAC address at the switch to contain a potential threat.

Answer

Initiate an Nmap scan against the device's IP address to identify open ports and services.

Answer

Isolate the physical switch port to which the device is connected for forensic analysis.

Question 4

Which of the following presents a unique and significant challenge for asset discovery in OT environments compared to traditional IT environments?

Accepted Answer

The presence of legacy systems and proprietary, non-IP-based protocols.

Answer

The use of dynamic IP addresses via DHCP makes tracking difficult.

Answer

The high volume of encrypted traffic obscures device details.

Answer

The frequent addition and removal of new devices on the network.

Question 5

An analyst is using a passive discovery tool that performs deep packet inspection (DPI) on industrial protocols. By analyzing a DNP3 outstation's response to a master station, which piece of information is the tool MOST likely to extract to enrich the asset inventory?

Accepted Answer

The device's specific model number and firmware version.

Answer

The username and password of the logged-in operator.

Answer

A list of installed Windows patches on the device.

Answer

The physical GPS coordinates of the outstation.

Question 6

A utility is implementing an asset visibility solution. The primary data source is network traffic captured from a TAP on a core switch connecting multiple PLCs and HMIs. Which of the following can be reliably determined SOLELY from this data source?

Accepted Answer

Whether a PLC's logic has been recently modified via its programming port.

Answer

The patch level of the operating system on an HMI.

Answer

A complete list of all local user accounts on a PLC.

Answer

The communication relationships and protocols used between assets.