Detecting Intrusions ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A chemical plant has a control network with multiple PLCs on a dedicated OT VLAN and a separate IT VLAN for business systems. A junction point connects the two VLANs through a stateful firewall. The security team wants to detect both external attacks from the IT side and internal misuse by operators on the OT side. They have two IDS sensors available. What is the most effective placement?

   • APlace both sensors on the OT VLAN to ensure maximum coverage of the most critical assets.
   • BPlace both sensors on the IT VLAN to maximize coverage of the higher-volume business traffic.
   • CPlace one sensor inline between the firewall and the OT VLAN and the other inline between the firewall and the IT VLAN.
   • DPlace one sensor on the OT VLAN to monitor all PLC traffic and the other on the IT side of the firewall to monitor incoming traffic.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An analyst notices an IDS alert for a series of EtherNet/IP packets from an engineering workstation to a PLC. The packets contain a CIP (Common Industrial Protocol) service code for 'Forward Open' that is being sent repeatedly to the same connection. The engineering team confirms they are not running any software that would generate this traffic. What is the most likely explanation for this alert?

   • AThe PLC is broadcasting its status to the engineering workstation, which is normal behavior.
   • BThe engineering workstation is performing a scheduled firmware update on the PLC.
   • CThe IDS is generating a false positive because EtherNet/IP is a complex protocol.
   • DThe engineering workstation has a virus that is scanning the network for open connections.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A regional water utility has deployed an IDS with both signature-based and anomaly-based detection. The IDS is placed at the boundary between the IT and OT networks. Over the past week, the IDS has generated the following alerts: (1) a signature match for a known exploit targeting a Windows-based HMI, (2) an anomaly alert for a sudden increase in Modbus traffic to a PLC that normally has low traffic, and (3) an anomaly alert for a new OPC UA connection from an unknown IP. The analyst has limited time and must prioritize which alert to investigate first. The HMI is a critical asset, the PLC is a non-critical pump controller, and the OPC UA connection is to a data historian. Which alert should be investigated first?

   • AThe anomaly alert for the OPC UA connection, because it is from an unknown IP and could be an external attacker.
   • BThe signature match for the HMI exploit, because it targets a critical asset and is a known attack technique.
   • CThe anomaly alert for the Modbus traffic, because it indicates a potential compromise of the PLC.
   • DAll three alerts equally, because each represents a potential intrusion and should be investigated in parallel.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a common attack vector targeting ICS/SCADA protocols such as Modbus or DNP3?

   • ASQL injection into a relational database
   • BCross-site scripting (XSS) in web applications
   • CDNS cache poisoning
   • DMan-in-the-middle attacks on unencrypted protocol communications
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst at a power utility is reviewing IDS alerts and notices a high volume of alerts triggered by a rule that flags any Modbus TCP packet with the function code 90 (0x5A), which is not a standard Modbus function code. The engineering team confirms that a legacy PLC model in the plant uses this code for a proprietary diagnostic command during normal maintenance. What is the most appropriate action for the analyst to take?

   • ADisable the IDS rule entirely to eliminate the noise and allow the maintenance team to work without interruption.
   • BCreate a suppression filter that ignores this specific alert when the source IP matches the known engineering workstation used for maintenance.
   • CImmediately block all traffic using function code 90 at the firewall to prevent potential attacks.
   • DIgnore the alerts and take no action since the engineering team confirmed the traffic is normal.
   Reveal Solution Discussion Select an answer first