Advantages and Limitations of IDS ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In an ICS/SCADA environment, when is an IDS most appropriately used despite its limitations?

   • AAs an inline device that automatically blocks malicious traffic without human intervention.
   • BAs a passive monitoring tool to gain visibility into control network traffic and detect anomalies.
   • CAs a tool to enforce security policies by actively terminating unauthorized sessions.
   • DAs a replacement for a firewall to protect the control network from external threats.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A manufacturing plant has a network IDS that is deployed in a passive mode. The plant manager wants to use the IDS to automatically block malicious traffic. What is the best recommendation?

   • AReplace the IDS with a firewall that has intrusion prevention features.
   • BUse the IDS to send blocking commands to the firewall automatically.
   • CKeep the IDS passive and use manual responses to alerts.
   • DConvert the IDS to an inline IPS to enable blocking, but carefully test to avoid disrupting production.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A natural gas facility has a network-based IDS that generates a high volume of alerts. The SOC team is overwhelmed and has started ignoring alerts. The management wants to improve the situation without adding staff. What is the most effective strategy?

   • ATune the IDS to reduce false positives and prioritize alerts based on risk to critical processes.
   • BDisable all alerts except those for critical function codes.
   • CIncrease the alert threshold so only the most severe alerts are generated.
   • DReplace the IDS with a SIEM that automatically correlates all alerts.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A pharmaceutical company must detect both network-based attacks and unauthorized changes to configuration files on engineering workstations. The team has budget for only one new security tool. Which approach provides the most balanced coverage for both requirements?

   • ADeploy a network-based IDS and use existing host logging to monitor configuration file changes.
   • BDeploy only a network-based IDS and assume it will detect configuration file changes.
   • CDeploy an inline IPS and disable all host logging to reduce noise.
   • DDeploy only a host-based integrity monitor and rely on it to detect network attacks.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A water utility has a flat OT network with legacy PLCs that cannot be patched. The security team wants visibility into unauthorized Modbus writes but has no budget for additional staff to analyze alerts. Which approach best balances the advantage of detecting intrusions with the limitation of alert fatigue?

   • ADeploy an inline IPS that automatically blocks any Modbus write that is not from the engineering workstation.
   • BDeploy a passive IDS with a baseline of normal Modbus traffic and alert only on deviations from that baseline.
   • CDeploy a network IDS with default signature set and a 24/7 managed security service provider to review alerts.
   • DDeploy a host-based IDS on each PLC to monitor local logs and send all alerts to the existing SIEM.
   Reveal Solution Discussion Select an answer first