Advantages and Limitations of IDS ICSSCADA Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A power plant uses a network IDS that relies on signature-based detection. The vendor releases a new signature for a vulnerability in a specific PLC model. What is the most significant limitation of this approach?

   • AThe IDS will generate false positives for all normal PLC traffic after the signature is added.
   • BThe IDS will automatically block all traffic to the vulnerable PLC once the signature is applied.
   • CThe IDS will require a firmware update on the PLC to apply the signature.
   • DThe IDS will only detect attacks that match the known signature; zero-day exploits against that PLC will not be detected.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A power utility has a network IDS that is monitored by a 24/7 security operations center (SOC). The SOC is receiving many alerts that are false positives. The utility wants to reduce the workload on the SOC without increasing the risk of missing real attacks. What is the best approach?

   • AIncrease the threshold for all alerts so only the most severe are sent to the SOC.
   • BAdd more IDS sensors to get more context, which will reduce false positives.
   • CDisable the IDS during low-risk periods to reduce alerts.
   • DImplement a risk-based alert prioritization system that ranks alerts by asset criticality and exploitability.
   Reveal Solution Discussion Select an answer first