Detecting Intrusions ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A water treatment facility is considering deploying an IPS in its ICS environment. The facility has a strict requirement that the control network must remain available at all times. The security team is evaluating whether to deploy the IPS in inline or passive mode. What is the most important consideration for this decision?

   • AInline IPS is always more secure than passive IPS because it can block attacks.
   • BInline IPS can block malicious traffic but introduces a point of failure, while passive IPS only detects and does not affect availability.
   • CThe choice between inline and passive IPS does not affect availability.
   • DPassive IPS is always more secure than inline IPS because it cannot be bypassed.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which detection methodology relies on a database of known attack patterns or signatures to identify intrusions?

   • AHeuristic-based detection
   • BBehavior-based detection
   • CAnomaly-based detection
   • DSignature-based detection
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A power utility's IDS generates an alert for a series of DNP3 function codes that are valid but occur in a sequence that has never been observed in the last 18 months of baseline traffic. The sequence involves a master station sending multiple unsolicited responses to a remote terminal unit (RTU). The security analyst must determine if this is a true positive. What is the most appropriate first step?

   • ACorrelate the alert with the asset owner's change-management records and recent maintenance schedules for the RTU.
   • BSuppress the alert because DNP3 function codes are all valid and therefore cannot indicate an attack.
   • CCompare the packet payloads against the signature database for known DNP3 exploits.
   • DImmediately block the master station's IP address at the firewall to contain the potential threat.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A chemical plant's IDS is configured to detect anomalies in the polling frequency of its PLCs. The plant's network team recently changed the polling interval for all PLCs from 500ms to 1 second to reduce network load. The IDS is now generating alerts for every PLC because the polling frequency deviates from the baseline. What is the most effective way to address this issue?

   • ACreate a suppression rule for all PLC polling traffic to prevent alerts.
   • BUpdate the IDS baseline to reflect the new polling interval of 1 second.
   • CDisable anomaly-based detection for polling frequency and rely on signature-based detection.
   • DIncrease the alert threshold so that only deviations greater than 50% from the baseline are reported.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst is monitoring a natural gas pipeline's SCADA network. The IDS generates an alert for a series of Modbus TCP write requests to a single coil register, rapidly cycling the value between 0 and 1 over a few seconds. The pattern is not a known signature. The engineering team confirms no scheduled test or maintenance is occurring. What does this behavior most likely indicate?

   • AA network switch is flooding the port with broadcast traffic, causing the PLC to misinterpret the data.
   • BThe IDS is generating a false positive due to a protocol parsing error.
   • CA misconfigured HMI is sending duplicate write commands due to a software bug.
   • DAn attacker is probing the PLC's response to rapid state changes to identify vulnerabilities.
   Reveal Solution Discussion Select an answer first