Detecting Intrusions ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security architect is designing an IDS for a natural gas pipeline that uses a mix of Modbus TCP and proprietary serial protocols. The pipeline has a central control center and remote pumping stations connected via a WAN. The team wants to detect both known attacks and unusual behavior, but the WAN bandwidth is limited and cannot support full packet capture at all locations. What is the most appropriate approach?

   • ADeploy a single IDS at the central control center and use firewall logs from remote stations for analysis.
   • BDeploy lightweight IDS sensors at the remote stations that send only alerts to the central control center.
   • CDeploy full packet capture IDS at the remote stations and send all data to the central control center for analysis.
   • DDeploy full packet capture IDS at the central control center and rely on it to monitor all traffic from remote stations.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which statement correctly describes the role of an intrusion prevention system (IPS) in an ICS/SCADA network?

   • AIt passively monitors traffic and only logs suspicious events for later review
   • BIt actively blocks or drops malicious traffic based on configured rules
   • CIt replaces the need for network segmentation in industrial control systems
   • DIt only detects attacks after they have already caused damage
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a primary consideration when placing an IPS inline in an ICS/SCADA network?

   • APlacing the IPS outside the firewall to inspect all incoming traffic
   • BConfiguring the IPS to block all traffic that does not match a known signature
   • CPlacing the IPS on a SPAN port to avoid any impact on traffic flow
   • DEnsuring the IPS does not introduce latency that could disrupt time-sensitive control communications
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An ICS security analyst observes a series of Modbus TCP packets from a single source IP to a PLC. The packets are all read-holding-register requests (function code 0x03), but the starting register address increments by exactly one register with each request, covering the entire 65,536-register address space in under two minutes. The requests are coming from an IP address that is not in the asset inventory. What does this pattern most likely indicate?

   • AThe PLC firmware is malfunctioning and generating spurious responses.
   • BA network loop is causing the same request to be replayed repeatedly.
   • CAn attacker is performing reconnaissance to map the PLC's register layout and identify process values.
   • DA legitimate HMI is performing a routine data-logging operation for the historian.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An IDS at a chemical plant generates an alert for a DNP3 packet with an unexpected application layer function code. The analyst checks the asset inventory and finds the source IP belongs to a newly installed remote terminal unit (RTU) that was recently added to the network. The RTU vendor's documentation confirms the function code is used for a new feature. What is the most appropriate response?

   • ABlock all DNP3 traffic from the RTU until the vendor can provide a patch.
   • BUpdate the IDS baseline or rule set to recognize the new function code as legitimate for the RTU's IP address.
   • CTreat the alert as a true positive and immediately isolate the RTU from the network.
   • DIgnore the alert and take no further action since the RTU is new and likely functioning correctly.
   Reveal Solution Discussion Select an answer first