Advantages and Limitations of IDS ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A water utility has deployed a network IDS that relies on signatures for known ICS exploits. They are concerned about targeted attacks using zero-day exploits. They are considering adding an anomaly-based detection module. What is the most important limitation they should consider?

   • AAnomaly-based detection may generate more false positives because normal operations can vary.
   • BAnomaly-based detection requires no tuning or baseline.
   • CAnomaly-based detection cannot detect zero-day exploits.
   • DAnomaly-based detection will completely replace signature-based detection.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In an ICS/SCADA environment, which of the following is a key advantage of deploying an intrusion detection system (IDS)?

   • AIt eliminates the need for regular security patching of ICS/SCADA devices.
   • BIt guarantees protection against all zero-day exploits targeting industrial protocols.
   • CIt can automatically block malicious network traffic in real time.
   • DIt provides visibility into network traffic and host activity, enabling detection of suspicious behavior.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why might an IDS have difficulty detecting attacks in an ICS/SCADA environment?

   • ABecause ICS protocols are often proprietary, undocumented, or have limited signatures available.
   • BBecause IDS solutions are not capable of analyzing network traffic.
   • CBecause ICS networks are always fully encrypted, preventing any inspection.
   • DBecause IDS solutions cannot be deployed in industrial environments due to certification requirements.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A power utility is deploying a network-based IDS across multiple substations. The team must choose between a centralized IDS that receives mirrored traffic over a WAN link and distributed IDS sensors at each substation with local analysis. The WAN link is congested and sometimes unreliable. What is the most appropriate decision?

   • ADeploy a centralized IDS and rely on the WAN link to carry all mirrored traffic.
   • BDeploy an inline IPS at each substation to reduce the need for monitoring.
   • CDeploy distributed IDS sensors at each substation with local analysis and forward only high-priority alerts to the central SOC.
   • DDeploy distributed sensors but do not forward any alerts to the central SOC.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An ICS security analyst notices that the network-based IDS generates hundreds of alerts for a known engineering workstation that periodically polls all PLCs for status. The analyst confirms these are normal operations. What is the most appropriate first step to improve the IDS effectiveness?

   • ADisable the IDS entirely to avoid alert fatigue.
   • BCreate a baseline and tune the IDS to suppress alerts that match the normal polling pattern.
   • CIncrease the sensitivity of all signatures to catch more anomalies.
   • DReplace the IDS with an IPS so it can block the polling traffic.
   Reveal Solution Discussion Select an answer first