GIAC Response and Industrial Defense (GRID) 認定 GRID 試験問題:

1. What type of detection tool can be used to analyze communications between devices on an ICS network to detect potential security breaches?

A) Word processing software
B) Network traffic analyzers
C) Digital forensics tools
D) Video surveillance

2. Your security team has received a high-priority alert from a network intrusion detection system (NIDS) monitoring an ICS environment. The alert indicates unusual outbound communication from an ICS device to an external IP address.
What steps should you take to investigate and mitigate this potential security threat?

A) Ignore the alert, as it may be a false positive
B) Increase the network bandwidth to handle more traffic
C) Investigate the outbound communication by reviewing the logs, isolate the affected device from the network, and escalate the issue to the incident response team
D) Immediately shut down all ICS devices

3. Your organization has deployed an IDS in an ICS environment, and the system has generated an alert indicating unusual communication between a remote workstation and a programmable logic controller (PLC).
How should you proceed with investigating this issue?

A) Restart the PLC to reset its communication logs
B) Disable the IDS system
C) Review the logs to identify the nature of the communication, verify if the workstation should have access to the PLC, and investigate the user's activity
D) Ignore the alert, as it could be a false positive

4. What role does asset discovery play in enhancing visibility in an ICS environment?

A) It helps reduce network bandwidth
B) It eliminates the need for manual updates
C) It identifies unknown or unmonitored devices that may pose security risks
D) It improves hardware performance

5. What is one major limitation of signature-based detection systems in ICS environments?

A) They are automatically updated in real-time
B) They improve system performance
C) They can detect unknown threats easily
D) They rely on pre-existing signatures and may fail to detect new or unknown threats

質問と回答：