Advantages and Limitations of IDS ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a recognized benefit of using an IDS in an ICS/SCADA network?

   • AIt can replace the need for network segmentation in critical control networks.
   • BIt can directly modify firewall rules to stop an ongoing attack.
   • CIt can provide forensic data that helps in post-incident analysis and compliance reporting.
   • DIt can automatically update the firmware of PLCs and RTUs when vulnerabilities are found.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A hospital's building management system (BMS) uses BACnet over IP. The security team wants to detect unauthorized changes to setpoints. What is the main advantage of using a network IDS for this?

   • AIt will replace the need for physical security on the BMS network.
   • BIt can passively monitor BACnet traffic and alert on write commands to setpoints that are not in a whitelist of authorized sources.
   • CIt will encrypt all BACnet traffic to prevent tampering.
   • DIt will automatically revert any unauthorized setpoint change to the original value.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An oil refinery has a mix of legacy serial RTUs and modern Ethernet-based controllers. They want to deploy an IDS to monitor both. What is the most significant limitation they will encounter?

   • AThe IDS will need to be placed inline, which will disrupt serial communications.
   • BThe IDS will require replacing all legacy RTUs with modern devices to be effective.
   • CThe IDS will not be able to detect any attacks because legacy protocols are inherently secure.
   • DNetwork-based IDS cannot directly monitor serial RTU traffic without additional protocol gateways or serial taps.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A chemical plant has a network IDS that is generating a high number of false positives because of normal batch process variations. The security team is considering tuning the IDS to reduce false positives. However, the plant manager is concerned that tuning may cause the IDS to miss real attacks. What is the best approach to balance these concerns?

   • ACreate a baseline of normal batch operations and tune the IDS to suppress alerts that match the baseline, while keeping sensitivity for deviations.
   • BTune the IDS to be less sensitive to reduce false positives, accepting a higher risk of missing attacks.
   • CTune the IDS to be more sensitive to reduce false negatives, accepting more false positives.
   • DDisable the IDS during batch operations to avoid false positives.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following best describes a trade-off when using an IDS in an ICS/SCADA environment?

   • AThe IDS blocks all malicious traffic but requires frequent updates to remain effective.
   • BThe IDS provides deep visibility but may generate false positives that require time to investigate.
   • CThe IDS eliminates the need for security analysts but requires more hardware.
   • DThe IDS reduces the need for network segmentation but increases the risk of data loss.
   Reveal Solution Discussion Select an answer first