GRID - GIAC Response and Industrial Defense Asset Discovery and Visibility Questions and Answers

Question 1

An OT security team needs to build a comprehensive asset inventory for a process control network that operates 24/7. Which asset discovery method should be prioritized to ensure operational safety and avoid disrupting sensitive real-time processes?

Accepted Answer

Using passive network monitoring to analyze traffic from a SPAN port or network TAP.

Answer

Passive network monitoring is the preferred initial method for asset discovery in OT environments because it does not send any traffic to the devices. It listens to existing communications to identify assets, their protocols, and their relationships without any risk of causing operational disruption, which is the highest priority in these critical systems. Active scanning can be disruptive, agents are often not supported on OT devices, and documentation can be outdated.

Question 2

A GRID analyst is creating an asset inventory with a focus on enabling effective vulnerability management. Which of the following asset attributes is MOST critical to collect for cross-referencing with vulnerability databases like CISA's KEV Catalog or MITRE's CVE database?

Accepted Answer

Vendor, model, and firmware version

Answer

Vulnerabilities are typically tied to specific products from a vendor, their hardware model, and most importantly, the exact version of the software or firmware running on them. To accurately identify which assets are susceptible to a known vulnerability, the vendor, model, and firmware version are the most critical pieces of information. While other attributes are important for the overall inventory, this combination is essential for vulnerability management.

Question 3

While passively monitoring a manufacturing network, an analyst's visibility platform identifies a new MAC address communicating via CIP (Common Industrial Protocol). The device's IP address is not in the authorized asset database. What is the safest and MOST effective next step to identify this device?

Accepted Answer

Continue passive analysis of the device's traffic to identify its role, vendor, and communication patterns.

Answer

The most appropriate initial action is to continue passive analysis. This allows the analyst to gather more context about the device—such as vendor-specific traffic, device type, and what other assets it is communicating with—without the risk of disruption. Acting prematurely by blocking or scanning the device could cause an operational issue if the device is a legitimate, albeit undocumented, part of the process. The goal is to gather intelligence first before taking a potentially disruptive action.

Question 4

Which of the following presents a unique and significant challenge for asset discovery in OT environments compared to traditional IT environments?

Accepted Answer

The presence of legacy systems and proprietary, non-IP-based protocols.

Answer

OT environments are characterized by a high prevalence of legacy systems that may be decades old and often use proprietary, non-IP-based, or specialized serial protocols. This heterogeneity and lack of standardization make it difficult for conventional IT discovery tools to identify and classify assets, posing a unique challenge not typically found in modern IT networks.

Question 5

An analyst is using a passive discovery tool that performs deep packet inspection (DPI) on industrial protocols. By analyzing a DNP3 outstation's response to a master station, which piece of information is the tool MOST likely to extract to enrich the asset inventory?

Accepted Answer

The device's specific model number and firmware version.

Answer

Many industrial protocols, including DNP3, have specific function codes or object variations that allow devices to identify themselves. Passive discovery tools with deep packet inspection capabilities can parse these protocol-specific fields to extract detailed information like vendor, model, and firmware version directly from network traffic, which is crucial for building an accurate inventory.

(GRID) GIAC Response and Industrial Defense Practice Test

(GRID) GIAC Response and Industrial Defense Practice Test

GRID - GIAC Response and Industrial Defense Asset Discovery and Visibility Questions and Answers