Detecting Intrusions ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key advantage of anomaly-based detection over signature-based detection in an ICS/SCADA environment?

   • AIt does not require any computational resources
   • BIt can detect previously unknown attacks that deviate from normal behavior
   • CIt requires no initial training or baseline establishment
   • DIt produces fewer false positives in dynamic industrial environments
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An IDS at a water treatment plant generates an alert for a series of Modbus TCP write requests to a PLC's holding registers. The writes are setting the registers to values that are outside the normal operating range. The source IP is a known engineering workstation. The engineering team confirms that no one is currently using the workstation. What is the most likely explanation for this alert?

   • AThe PLC is malfunctioning and sending its register values to the engineering workstation.
   • BThe engineering workstation is running a scheduled automated test that writes test values to the PLC.
   • CAn attacker has compromised the engineering workstation and is using it to send malicious commands to the PLC.
   • DThe IDS is generating a false positive because Modbus TCP is a common protocol.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a typical ICS/SCADA network with a DMZ between the corporate IT network and the control network, where is the most appropriate location to place an IDS sensor to monitor traffic entering the control network from the DMZ?

   • AOn the internet-facing router
   • BOn the corporate IT network segment
   • COn the control network segment, just inside the firewall that separates it from the DMZ
   • DOn the DMZ segment
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team is deploying an IPS for a railway signaling system. The system has a redundant network architecture with two separate paths for critical control traffic. The team wants to ensure that the IPS does not become a single point of failure. What is the most appropriate deployment strategy?

   • ADeploy the IPS in passive mode on both network paths, monitoring traffic without being inline.
   • BDeploy two IPS devices, one on each redundant network path, configured in active-passive mode.
   • CDeploy a single IPS at the network core and route all traffic through it.
   • DDeploy a single IPS inline on the primary network path and rely on the secondary path for failover.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A manufacturing plant's IDS is configured to alert on any deviation from the normal polling frequency of the PLCs. The plant recently added a new HMI that polls the PLCs at a different interval than the legacy HMI. The IDS is now generating a high volume of alerts. The security team needs to reduce false positives while maintaining detection of actual anomalies. What is the most effective approach?

   • ACreate a signature to suppress alerts from the new HMI's IP address.
   • BDisable anomaly-based detection and rely solely on signature-based detection for known attacks.
   • CRetrain the anomaly-based detection model using a new baseline that includes the new HMI's polling pattern.
   • DIncrease the alert threshold so that only major deviations from the original baseline are reported.
   Reveal Solution Discussion Select an answer first