Advantages and Limitations of IDS ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A manufacturing plant uses encrypted proprietary protocols between controllers and HMIs. The security team wants to deploy a network IDS to detect command injection attempts. What is the primary limitation they will face?

   • AThe IDS will generate excessive alerts because proprietary protocols are not well understood.
   • BThe IDS will require replacing all switches with TAPs to see the traffic.
   • CThe IDS will slow down the network because it must decrypt all traffic in real time.
   • DThe IDS will not be able to inspect the payload of encrypted traffic, so it may miss attacks hidden in the protocol.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A wastewater treatment plant has a network IDS that generates a high volume of alerts. The team has limited time to investigate. What is the most effective way to improve the usefulness of the IDS?

   • AIncrease the number of signatures to catch more threats.
   • BSet the IDS to automatically block all flagged traffic.
   • CDeploy the IDS on every network segment to get more context.
   • DPrioritize alerts based on the criticality of the affected asset and the severity of the potential impact.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A water treatment facility has a flat OT network with legacy PLCs that cannot be patched. The security team wants visibility into anomalous Modbus commands without disrupting production. Which approach best leverages the advantages of an IDS while addressing its limitations in this environment?

   • ADeploy a passive network-based IDS on a SPAN port of the OT switch and baseline normal Modbus traffic patterns.
   • BInstall an inline IPS that automatically blocks any Modbus write command not seen in the last 30 days.
   • CUse a signature-based IDS with default IT rules and alert on any Modbus traffic.
   • DDeploy a host-based IDS agent on each legacy PLC to monitor local process logic.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A chemical plant has a network IDS that frequently alerts on normal maintenance activities, such as firmware updates and configuration changes. The operators have started ignoring alerts. What is the best way to address this limitation?

   • AReplace the IDS with a host-based system on all controllers.
   • BTune the IDS rules and create a baseline of normal maintenance activities to reduce false positives.
   • CIncrease the alert threshold so only critical alerts are generated.
   • DDisable alerts for maintenance windows entirely.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A food processing plant has a flat network with no segmentation. They want to deploy an IDS to detect lateral movement from the IT network to the OT network. What is the main limitation they will face?

   • AThe IDS will only detect attacks that originate from the IT side.
   • BWithout network segmentation, the IDS will see all traffic but may not be able to distinguish OT-specific attacks from IT background noise.
   • CThe IDS will automatically segment the network to isolate OT devices.
   • DThe IDS will not be able to see any traffic because it requires a segmented network.
   Reveal Solution Discussion Select an answer first