GIAC GRID Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Response and Industrial Defense (GRID) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GRID certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GRID Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Response and Industrial Defense (GRID) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Response and Industrial Defense exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GRID Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GRID Sample Questions:
01. Investigating an intrusion at a water utility, an analyst learns that the adversary first compromised a jump server owned by a maintenance contractor and then used that server to open sessions into the utility's SCADA network. She is now documenting the Diamond Model event for the sessions into the utility.
In that event, which feature does the contractor's jump server represent?
a) Capability deployed in the event
b) Infrastructure used to reach the victim
c) Victim of the compromise that came first
d) Adversary at the source of those sessions
02. Overnight, a burst of setpoint writes reached a chlorine-dosing PLC at a water utility. The protocol log shows each WRITE_SINGLE_REGISTER request followed by a normal response. A colleague argues the values must have been within safe dosing limits, since the PLC never returned exception 03 (ILLEGAL DATA VALUE).
How should the analyst respond?
a) Disagree, because the protocol does not judge whether a value is safe for the process
b) Agree, because exception 03 is the PLC's check that a written value lies inside its process range
c) Disagree, because exception 03 is returned only for read requests and never for any write request
d) Agree, because a normal response shows that an authorized master sent each one of those writes
03. An inventory team at a district heating plant has the IP and MAC address of every device on a Modbus/TCP segment, but the role field is still empty: nobody has recorded which devices issue requests and which answer them. A passive sensor already watches the segment.
Which source fills the role field most directly?
a) The sensor's Modbus transaction log of each request and response
b) The MAC address tables held by the segment's access switches
c) A Read Device Identification query sent to each address on the segment
d) The sensor's Modbus master/slave tracking log
04. Your district heating company shared a STIX Indicator for a malicious domain with a partner through the sector ISAC. The partner wants to report back that it saw that domain 14 times on its own network last week, in an object linked to your indicator object.
Which STIX object should the partner send?
a) A Sighting that references the shared Indicator, with a count of 14
b) An Observed Data object listing the 14 connections
c) An Attack Pattern describing the domain's use
d) A new Indicator carrying the same domain pattern
05. Before hunting on a natural-gas pipeline operator's compressor-station network, the hunt lead writes down three statements the hunt plan relies on: the vendor VPN is used only by the vendor, the RTUs accept commands only from the SCADA master, and the cellular backup link is disabled. The team must test each one and note what would make them drop it before the hunt is scoped.
Which structured analytic technique is the lead applying?
a) Team A/Team B with two groups building rival views
b) Analysis of Competing Hypotheses on the hunt's evidence
c) A Key Assumptions Check on the plan's working beliefs about the network
d) Devil's Advocacy against the team's agreed judgment
06. Drive contractors at a natural-gas pipeline operator plug laptops into the panel switches at remote compressor stations to tune motor drives. The operator's passive sensors cover only the Level 2 network at the control center, and the laptop-to-drive traffic stays on each panel switch.
Which source records when, and on which switch port, a contractor laptop connected?
a) The historian's trend records of speed and flow for the compressor drives
b) The quarterly asset walkdown of each remote compressor station
c) Connection-status events from the panel switches, such as link-up and SNMP notifications, sent to a central log server
d) The control center's Level 2 passive sensor, correlating its connection records with the contractors' scheduled work orders for each station
07. After an intrusion at a snack-food plant, an analyst documents nine Diamond events involving one adversary and the plant. She orders them by phase, from the phishing message that opened access to the copying of PLC project files, to show where a detection could have broken the sequence.
What has she built?
a) A Collection Management Framework for the plant
b) An activity group for the adversary
c) A single event with extended meta-features
d) An activity thread
08. Control engineers at a district heating plant receive a polite email from someone who says they are a new support contact at the plant's DCS vendor. The sender asks for the plant's network drawings and a list of controller models "to update support records."
What should the engineers do with this email?
a) Forward it to procurement so the support contract number can be checked
b) Report it to the security team as a request for information about the plant's architecture
c) Delete it and take no further action, since no system has been touched
d) Reply with the drawings and model list, since the vendor already holds details of its own products
09. While building the OT taxonomy for a gas-processing plant, the team groups together the pair of firewalls and the fiber link that carry all traffic between the process-control zone and the safety-system zone. Those devices do nothing except carry that communication.
In ISA/IEC 62443 terms, what does this grouping represent?
a) A collection point in the Collection Management Framework
b) A zone of its own
c) A conduit between the two zones
d) An industrial DMZ between the two zones
10. Leadership at a natural-gas pipeline operator asks whether a campaign that has so far hit only the IT networks of sector peers is moving toward operational technology. The analyst lists events she would expect to see if it were (reports of OT-specific tooling, theft of engineering files at peers and targeting of the sector's SCADA vendors) and reviews the list each month.
Which structured analytic technique is she using?
a) Analysis of Competing Hypotheses
b) Devil's Advocacy
c) "What If?" Analysis
d) Indicators or Signposts of Change
Answers:
|
Question: 01 Answer: b |
Question: 02 Answer: a |
Question: 03 Answer: d |
Question: 04 Answer: a |
Question: 05 Answer: c |
|
Question: 06 Answer: c |
Question: 07 Answer: d |
Question: 08 Answer: b |
Question: 09 Answer: c |
Question: 10 Answer: d |
Note: For any error in GIAC Response and Industrial Defense (GRID) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
