GIAC Response and Industrial Defense (GRID) 認定 GRID 試験問題:

1. Which of the following techniques can help reduce false positives in an ICS detection system?

A) Reducing the number of monitored devices
B) Implementing anomaly-based detection to complement signature-based detection
C) Only monitoring external traffic
D) Disabling the detection system during normal operations

2. You are responsible for implementing active defense mechanisms in a critical infrastructure ICS environment. After reviewing traffic logs, you identify repeated attempts to access an ICS network segment from an external source.
How should you proceed with mitigating this threat?

A) Ignore the attempts and continue regular operations
B) Review firewall settings, block the IP addresses involved in the access attempts, and implement additional network segmentation to isolate critical systems
C) Terminate all external connections to the ICS environment
D) Increase system capacity to handle more traffic

3. Which of the following is a common source of threat intelligence for ICS environments?

A) Personal social media accounts
B) E-commerce websites
C) Streaming platforms
D) Publicly available databases of known vulnerabilities and exploits

4. What is the role of threat intelligence in threat hunting?

A) To increase system uptime
B) To provide context and information about known threats that can guide threat hunting activities
C) To automate system backups
D) To replace network devices

5. What type of threat data can be collected from ICS endpoint devices during a threat hunting exercise?

A) Network traffic data
B) Daily task lists
C) Financial transaction logs
D) Social media activity

質問と回答：