Advantages and Limitations of IDS ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A power utility is evaluating IDS deployment for its substation networks. The team notes that encrypted protocols are increasingly used between modern RTUs. What is the most significant limitation this introduces for a network-based IDS?

   • AEncrypted traffic causes the IDS to reboot due to resource exhaustion.
   • BThe IDS will require a full firmware update on every RTU to support decryption.
   • CThe IDS will automatically block encrypted traffic because it cannot read the packets.
   • DThe IDS cannot inspect encrypted payloads without decryption, so it may miss malicious commands hidden inside encrypted sessions.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A water utility has deployed a network-based IDS that uses deep packet inspection (DPI) for Modbus TCP. During peak flow periods, the IDS drops packets because the CPU is saturated. The team must maintain detection accuracy without upgrading hardware. What is the most effective mitigation?

   • AApply more specific DPI rules that focus only on critical function codes and known attack patterns, reducing per-packet processing.
   • BMove the IDS to a different network segment with less traffic.
   • CDisable DPI and rely only on packet header analysis.
   • DIncrease the SPAN port speed to capture more traffic.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A utility company is required to demonstrate to regulators that it has visibility into its OT network. The team has a limited budget and must choose between a commercial IDS with vendor support and an open-source IDS with in-house expertise. Which factor is most important in this decision?

   • AOpen-source IDS is always free and requires no maintenance.
   • BThe in-house team's ability to maintain, tune, and respond to alerts from the chosen IDS.
   • CThe regulator will only accept commercial IDS products.
   • DThe commercial IDS always provides better detection than open-source.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A food and beverage manufacturer has a mix of modern and legacy PLCs. The security team wants to deploy a network-based IDS, but the network team warns that some switches do not support SPAN ports. What is the most practical alternative to gain visibility?

   • AReplace all switches with models that support SPAN ports.
   • BInstall the IDS inline between each PLC and the switch.
   • CUse only host-based IDS agents on the PLCs.
   • DInsert a network TAP on the trunk links between the switches and the PLCs.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A natural gas pipeline company has a network IDS that monitors the control network. They want to use the IDS to support incident response and forensic investigations. However, the IDS only stores alert metadata, not full packet captures. What is the best way to address this limitation?

   • AUse the alert metadata alone because it is sufficient for most investigations.
   • BEnable full packet capture on the IDS sensor for all traffic, even if it requires significant storage.
   • CDeploy a separate packet capture system that records traffic to a high-capacity storage array.
   • DRely on the IDS to reconstruct the attack from memory.
   Reveal Solution Discussion Select an answer first