Detecting Intrusions ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In an ICS/SCADA environment, what is the primary role of an intrusion detection system (IDS)?

   • ATo encrypt all communication between field devices and the control center
   • BTo replace the need for firewalls in industrial networks
   • CTo actively block malicious network traffic in real time
   • DTo monitor network traffic and generate alerts when suspicious activity is detected
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An analyst at a manufacturing plant is reviewing IDS alerts and sees a high-priority alert for a known exploit targeting a specific PLC model. The alert is triggered by traffic from an engineering workstation to a PLC. The engineering team confirms that the workstation is used for programming and has the latest antivirus. The PLC is a model that is not in the plant's asset inventory. What is the most appropriate action?

   • ABlock all traffic from the engineering workstation to the PLC to prevent the exploit.
   • BInvestigate the PLC to confirm its model and check if it is actually vulnerable to the exploit.
   • CTreat the alert as a true positive and immediately disconnect the PLC from the network.
   • DIgnore the alert because the engineering workstation has the latest antivirus and is likely not compromised.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An IDS at a wastewater treatment plant detects a series of CIP (Common Industrial Protocol) packets where the source and destination IP addresses are the same. The packets are being sent to the PLC's EtherNet/IP port. What does this pattern most likely indicate?

   • AA legitimate diagnostic tool is testing the PLC's loopback interface.
   • BThe IDS is experiencing a false positive due to a firmware bug in the sensor.
   • CA network misconfiguration is causing the PLC to send packets to itself.
   • DAn attacker is using a spoofed source address to bypass access control lists that filter based on source IP.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An IDS at a food processing plant generates an alert for a single abnormal packet sent to a PLC's configuration port. The packet contains a string of characters that matches a known exploit signature for a different type of device. The PLC is a legacy model that is not known to be vulnerable to this exploit. What is the most appropriate initial response?

   • AInvestigate the source of the packet and check for other related alerts before taking action.
   • BIgnore the alert because the PLC is not vulnerable to the exploit.
   • CBlock all traffic to the PLC's configuration port to prevent any potential exploitation.
   • DTreat it as a true positive and immediately shut down the PLC to prevent damage.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An ICS security team is evaluating detection methodologies for a pipeline control system. The system has a well-defined and stable set of operations, but the team is concerned about insider threats from operators who have legitimate access. They are also concerned about sophisticated external attackers who may use valid credentials. The team needs a detection method that can identify malicious activity even when the activity uses valid commands and credentials. Which detection methodology is most appropriate?

   • AA combination of signature-based and anomaly-based detection, with no behavior-based component.
   • BSignature-based detection, which matches traffic against known attack patterns.
   • CAnomaly-based detection, which flags any deviation from a statistical baseline of network traffic.
   • DBehavior-based detection, which establishes a baseline of normal operator and system behavior and flags deviations.
   Reveal Solution Discussion Select an answer first