GRID - GIAC Response and Industrial Defense ICS Incident Response Questions and Answers

Question 1

An incident responder is analyzing network traffic from a compromised Human-Machine Interface (HMI) in a power generation facility.
The primary goal is to understand the attacker's commands without causing further disruption to the operational process.
Which of the following is the MOST appropriate initial step?

Accepted Answer

Utilize passive network monitoring and deep packet inspection of ICS protocols.

Answer

Isolate the HMI from the network immediately to prevent lateral movement.

Answer

Perform a full forensic image of the HMI's hard drive while it is running.

Answer

Deploy an agent to the HMI for real-time memory analysis and process logging.

Question 2

During which phase of the ICS incident response lifecycle is the primary focus on limiting the impact of an incident and preventing it from spreading to other systems?

Accepted Answer

Containment

Answer

Preparation

Answer

Eradication

Answer

Recovery

Question 3

A manufacturing plant has experienced a cybersecurity incident where malware was found on an engineering workstation. The incident response plan prioritizes safety and operational continuity above all else. Which of the following containment strategies would be MOST appropriate in this scenario?

Accepted Answer

Disconnect the single affected workstation and monitor the process network for anomalies.

Answer

Immediately shut down the entire plant network to perform a full security sweep.

Answer

Apply a software patch to the malware on the live system to neutralize its effects.

Answer

Re-route critical process control traffic through a new, isolated network segment.

Question 4

Which of the following is a unique challenge when performing digital forensics and incident response (DFIR) in an ICS environment compared to a traditional IT environment?

Accepted Answer

The use of proprietary protocols and legacy systems with limited logging.

Answer

The need to preserve a chain of custody for evidence.

Answer

The requirement to report incidents to regulatory authorities.

Answer

The difficulty in acquiring and analyzing volatile memory (RAM).

Question 5

According to NERC CIP-008, what is the required timeframe for a Responsible Entity to provide initial notification after determining that a Cyber Security Incident has occurred?

Accepted Answer

Within 1 hour

Answer

Within 4 hours

Answer

Within 24 hours

Answer

By the end of the next calendar day

Question 6

An incident response team is conducting a "lessons learned" session following a ransomware attack that impacted a water utility's SCADA system. Which of the following activities is the MOST critical outcome for this phase?

Accepted Answer

Identifying the root cause and updating the incident response plan to prevent recurrence.

Answer

Restoring all affected systems from the most recent backups.

Answer

Completing the final report for regulatory compliance.

Answer

Calculating the total financial cost of the incident for insurance purposes.