GRID - GIAC Response and Industrial Defense ICS Threat Intelligence Questions and Answers

Question 1

An OT security analyst at a chemical plant needs to gather threat intelligence specifically related to adversaries targeting their sector.
Which of the following sources would provide the MOST relevant and contextualized information?

Accepted Answer

The Chemical Sector Information Sharing and Analysis Center (ISAC).

Answer

A generic feed of phishing-related domain names from a commercial provider.

Answer

Public vulnerability feeds like the National Vulnerability Database (NVD).

Answer

A dark web forum discussing the sale of general corporate network access credentials.

Question 2

Which of the following is the BEST example of strategic threat intelligence for an ICS environment?

Accepted Answer

A detailed report on the geopolitical motivations and long-term objectives of nation-state actors targeting the global energy sector.

Answer

A list of malicious IP addresses associated with a recent malware campaign.

Answer

A Snort signature designed to detect a specific variant of ICS malware.

Answer

A reverse-engineered analysis of a command used by an adversary to interact with a PLC.

Question 3

A threat intelligence analyst receives a bulletin from CISA detailing a new malware variant that targets a specific PLC model used in their facility. The malware uses a non-standard UDP port for command and control (C2). What is the most effective IMMEDIATE action to take based on this tactical intelligence?

Accepted Answer

Create a firewall rule to block the specific C2 port and a detection rule in the network security monitor to alert on traffic using that port.

Answer

Share the bulletin with senior management to request additional budget for security.

Answer

Begin a long-term project to replace all instances of the vulnerable PLC model.

Answer

Conduct a full vulnerability scan of the entire OT network.

Question 4

When analyzing an adversary's behavior within an OT network, a security analyst uses a framework that maps observed actions like "Modify Control Logic" and "Inhibit Response Function" to a common knowledge base of adversary techniques. Which framework is being used?

Accepted Answer

MITRE ATT&CK® for ICS

Answer

The Cyber Kill Chain®

Answer

The Diamond Model of Intrusion Analysis

Answer

NIST Cybersecurity Framework (CSF)

Question 5

A threat actor is observed using techniques specifically designed to manipulate a Safety Instrumented System (SIS) with the apparent goal of causing a physical consequence. This profile is MOST closely associated with which adversary group?

Accepted Answer

XENOTIME

Answer

Sandworm Team

Answer

APT1 (Comment Crew)

Answer

Dragonfly / Energetic Bear

Question 6

A threat intelligence team has just finished collecting raw data from various sources, including sensor logs, vendor reports, and OSINT. The data is in multiple formats and contains a high volume of noise. According to the standard intelligence lifecycle, what is the immediate next phase?

Accepted Answer

Processing

Answer

Analysis

Answer

Dissemination

Answer

Feedback