Advantages and Limitations of IDS ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A power utility is required to report cyber incidents to regulators. They have a network IDS but no dedicated security team. What is the main advantage of the IDS in this context?

   • AIt replaces the need for a SIEM because it stores all network traffic for years.
   • BIt provides a log of detected suspicious activity that can be used to support incident reporting and forensic analysis.
   • CIt automatically blocks malicious traffic, preventing the incident from occurring.
   • DIt eliminates the need for manual log review by prioritizing all alerts automatically.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A natural gas pipeline company wants to monitor for insider threats by employees who have legitimate access to the HMI. They deploy a network IDS. What is the main advantage of this approach?

   • AThe IDS can detect unusual command sequences even if the employee uses valid credentials, by comparing against a baseline of normal operator behavior.
   • BThe IDS will require the employee to authenticate with a second factor.
   • CThe IDS will replace the need for user activity logging on the HMI.
   • DThe IDS will prevent the insider from sending any commands to the PLC.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A cybersecurity analyst is reviewing IDS alerts in a wastewater plant and finds that a known SCADA protocol implementation sends non-standard flag combinations during normal operation. The IDS flags these as attacks. What is the best way to handle this situation?

   • ACreate custom signatures or whitelist rules that account for the vendor-specific protocol behavior.
   • BIgnore all alerts from that protocol because they are always false positives.
   • CReplace the IDS with an IPS to automatically block the non-standard traffic.
   • DDisable the IDS during normal operations and enable it only during maintenance windows.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A regional airport's baggage handling system uses a mix of Ethernet/IP and legacy serial links. The security manager wants to detect cyber threats without affecting the time-critical control loops. Which IDS advantage is most relevant to this scenario?

   • AIDS can automatically block malicious traffic before it reaches the PLCs.
   • BIDS can replace the need for network segmentation.
   • CPassive monitoring provides visibility without adding latency to time-critical control traffic.
   • DIDS can guarantee detection of all zero-day attacks.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a common limitation of an IDS in an ICS/SCADA environment?

   • AIt eliminates the need for human analysis of security events.
   • BIt can block legitimate ICS protocols, causing production downtime.
   • CIt requires the installation of agents on every PLC and RTU.
   • DIt can generate false positives, which may desensitize operators to real alerts.
   Reveal Solution Discussion Select an answer first