ICS/SCADA Protocols ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is investigating a suspected cyber attack on a SCADA system that uses Modbus TCP. The analyst reviews the firewall logs and sees that an external IP address was able to send Modbus frames to a PLC. The firewall was configured to allow Modbus TCP traffic from any source. What is the most critical weakness that allowed this attack?

   • AThe PLC has a default password
   • BModbus TCP uses a well-known port
   • CThe firewall was configured with an overly permissive rule
   • DModbus TCP does not support encryption
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is reviewing a packet capture from a DNP3 network and notices that the master station is sending 'Read' requests to an RTU for a point that is not configured in the RTU's database. The RTU responds with a 'No such point' error. The analyst also sees that the master is sending 'Write' requests to a different point that is configured, but the value being written is outside the normal operating range. What should the analyst conclude?

   • AThe master station may be compromised or misconfigured
   • BThe master is performing a routine configuration audit
   • CThe network is experiencing packet loss
   • DThe RTU is malfunctioning
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst is examining a packet capture from a mixed ICS network that uses both Modbus TCP and DNP3. The analyst sees a series of Modbus TCP frames from an unknown IP address to a PLC, each with a different function code (e.g., 0x01, 0x03, 0x05, 0x06, 0x10). The frames are sent in rapid succession. The analyst also notices that the same unknown IP is sending DNP3 frames to an RTU with a variety of function codes. What is the most likely explanation for this traffic pattern?

   • AThe PLCs and RTUs are broadcasting their capabilities
   • BAn attacker is scanning for vulnerable function codes and mapping the network
   • CThe network is experiencing a broadcast storm
   • DThe SCADA master is performing a routine health check
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which protocol family is used to enable interoperability between different vendors' industrial devices and software, often acting as a bridge between SCADA systems and databases?

   • AOPC
   • BHART
   • CModbus
   • DDNP3
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is evaluating the risk of a legacy Modbus TCP network that controls a critical manufacturing process. The team has identified that the protocol lacks authentication and encryption. They are considering two mitigations: (1) deploying an industrial firewall that only allows traffic from the HMI IP to the PLCs, and (2) upgrading to OPC UA with security. The process cannot tolerate downtime for the upgrade. What is the most appropriate immediate mitigation?

   • AImplement application-layer encryption on the Modbus TCP traffic using a VPN tunnel.
   • BDisable the Modbus TCP service on the PLCs until the upgrade is complete.
   • CDeploy the industrial firewall with strict allow-listing of source IPs and protocol filtering.
   • DUpgrade to OPC UA with security as soon as possible, even if it requires a planned outage.
   Reveal Solution Discussion Select an answer first