Detecting Intrusions ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team is evaluating detection technologies for a wastewater treatment facility. The environment has a highly predictable traffic pattern: the same set of PLCs polling the same registers at fixed intervals. The team is concerned about zero-day attacks and insider threats that do not match known signatures. Which detection methodology is best suited for this environment?

   • AAnomaly-based detection, as the predictable traffic patterns make it easier to establish a reliable baseline and flag deviations.
   • BBehavior-based detection, as it can identify malicious intent by analyzing the sequence of actions over time.
   • CA combination of signature and behavior-based detection, as this is the industry standard for all ICS environments.
   • DSignature-based detection, as it has the lowest false positive rate and is easy to maintain.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An IDS at a chemical plant generates an alert for a DNP3 packet with a function code that is not in the standard DNP3 specification. The source IP is a newly installed intelligent electronic device (IED) from a vendor that has been used in other plants. The analyst checks the vendor's documentation and finds the function code is a proprietary extension. However, the analyst also notices that the IED is sending this function code to a PLC that is not from the same vendor. What is the most appropriate response?

   • AInvestigate the communication pattern between the IED and the PLC to determine if the proprietary function code is being used appropriately.
   • BTreat the alert as a false positive because the function code is documented by the vendor.
   • CBlock all DNP3 traffic from the IED to the PLC until the vendor can confirm the behavior is expected.
   • DUpdate the IDS rule to whitelist the function code for the IED's IP address.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   After confirming that an IDS alert corresponds to a real intrusion attempt on a control system, what is the most appropriate immediate response action?

   • AIgnore the alert and continue normal operations
   • BImmediately shut down the entire control system
   • CInitiate the incident response plan and isolate affected systems if safe to do so
   • DDisable the IDS to prevent further alerts
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An IDS at a water utility generates an alert for a series of Modbus read requests from a known engineering workstation to a PLC. The requests are for register addresses that are not typically accessed by this workstation. The analyst reviews the workstation's recent activity and finds that a new software tool was installed yesterday for a scheduled maintenance task. What is the most appropriate action?

   • ATreat the alert as a false positive and take no further action.
   • BTreat the alert as a true positive and block the workstation's access to the PLC.
   • CDisable the IDS alert for this workstation to prevent future false positives.
   • DVerify that the maintenance task is scheduled and that the new tool is authorized, then update the IDS baseline to include the new access pattern.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A pharmaceutical company is deploying an IDS in its ICS environment. The environment includes a batch process control system that uses a proprietary protocol. The security team is concerned about both known attacks and zero-day exploits. They also need to minimize false positives to avoid alert fatigue among the operators who monitor the IDS. Which combination of detection methodologies is most appropriate?

   • AUse only anomaly-based detection to catch all unknown threats.
   • BUse only signature-based detection to minimize false positives.
   • CUse behavior-based detection only, as it covers both known and unknown attacks.
   • DUse signature-based detection for known attacks and behavior-based detection for zero-day exploits and insider threats.
   Reveal Solution Discussion Select an answer first