Detecting Intrusions ICSSCADA Practice Questions (Page 8)

Questions 36–37

1. 36application · medium

   A power generation facility has a legacy serial-based SCADA system that uses Modbus RTU over RS-485. The security team wants to add intrusion detection for this legacy segment. The serial bus connects several RTUs to a single master station. What is the most appropriate way to gain visibility into this serial traffic?

   • AUse the master station's logging feature to record all Modbus RTU traffic and review it manually.
   • BReplace the serial bus with an Ethernet network and deploy a standard network IDS.
   • CDeploy a serial TAP or passive tap on the RS-485 bus and connect it to an IDS that supports serial protocols.
   • DInstall an inline serial firewall between the master and the RTUs to inspect and block traffic.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   An IDS generates an alert for a known exploit signature, but upon investigation, the traffic is actually a legitimate engineering workstation performing a firmware update. How should this alert be classified?

   • ATrue positive
   • BFalse positive
   • CTrue negative
   • DFalse negative
   Reveal Solution Discussion Select an answer first