Detecting Intrusions ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which intrusion pattern is specifically associated with unauthorized commands sent to a PLC (Programmable Logic Controller) over an industrial network?

   • AExcessive DNS queries to external domains
   • BA large number of failed SSH login attempts
   • CUnusual outbound email traffic
   • DMalformed or unexpected Modbus function codes in network traffic
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security architect is designing an IDS solution for a pharmaceutical manufacturing facility. The facility has a mix of modern and legacy PLCs, some of which use proprietary protocols. The team wants to detect both known attacks and unusual behavior without overwhelming the analysts with alerts. Which approach best balances these requirements?

   • ADeploy a hybrid IDS that combines signature-based detection for known threats and anomaly-based detection for unknown threats.
   • BDeploy a signature-based IDS only, as it is the most reliable and produces few false positives.
   • CDeploy a behavior-based IDS that focuses on the sequence of operations and user actions.
   • DDeploy an anomaly-based IDS that learns the normal traffic patterns and flags deviations.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A manufacturing company is deploying an IPS to protect its PLCs from known exploits. The network uses a standard three-tier architecture: Level 3 (site operations), Level 2 (supervisory control), and Level 1 (basic control). The security team wants to block malicious traffic before it reaches the PLCs. Where should the IPS be placed to be most effective?

   • AOn each PLC's serial port, inspecting all traffic at the device level.
   • BBetween Level 3 and Level 2, inspecting all traffic entering the control system zone from the site operations network.
   • CAt the internet edge, inspecting all inbound traffic before it enters the corporate network.
   • DBetween Level 2 and Level 1, inspecting all traffic destined for the PLCs from the supervisory control level.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security architect is selecting an IDS for a large water distribution network with hundreds of remote pumping stations connected via a WAN. The traffic patterns are highly variable due to seasonal demand and maintenance schedules. The team needs to detect both known attacks and unusual behavior, but the analyst team is small and cannot handle a high volume of false positives. Which detection methodology should be the primary approach?

   • AAnomaly-based detection with a baseline that is updated regularly to account for seasonal changes.
   • BA hybrid approach using signature-based detection for known attacks and anomaly-based detection with a carefully tuned baseline for unknown threats.
   • CBehavior-based detection that focuses on the sequence of operations and user actions.
   • DSignature-based detection, as it has the lowest false positive rate and is easy to maintain.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst at a nuclear facility is reviewing IDS alerts and finds a series of alerts for Modbus TCP writes to a single register on a cooling pump PLC. The writes are incrementing the register value by 1 every few seconds. The engineering team confirms that the register is not used for any normal control function and is not mapped in the HMI. The source IP is a rarely used maintenance laptop. What is the most appropriate action?

   • AIgnore the alert because the register is not mapped in the HMI, so it cannot affect the physical process.
   • BImmediately block the maintenance laptop's IP address at the firewall to prevent further writes.
   • CInvestigate the maintenance laptop for signs of compromise and review its recent activity logs.
   • DTreat this as a false positive because the register is not used for normal operations and the source is a known maintenance laptop.
   Reveal Solution Discussion Select an answer first