ICS/SCADA Protocols ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is reviewing captured Modbus TCP traffic between a SCADA master and a field device. The analyst notices that the master is sending write commands to a coil address that is not part of the documented control logic. Which inherent characteristic of Modbus makes this type of unauthorized write possible?

   • AThe protocol uses broadcast addressing for all writes
   • BUse of UDP instead of TCP for transport
   • CEncryption is optional and often disabled
   • DLack of authentication and authorization in the protocol
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is reviewing a packet capture from a DNP3 network and notices that the master station is sending a large number of 'Write' requests to an RTU, each targeting a different internal point. The RTU is responding with 'Write' confirmation messages. What should the analyst flag as the most likely anomaly?

   • AThe RTU is experiencing a communication timeout
   • BThe master is performing unauthorized writes to the RTU
   • CThe RTU is broadcasting its data to all devices
   • DThe master is using an unsupported DNP3 object variation
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is designing a new SCADA system for a wind farm. The turbines use IEC 61850 for internal communication, and the SCADA master uses DNP3. The design team must choose a gateway to translate between the two protocols. The gateway will be deployed in a remote, unattended location. Which feature is most important for the gateway to support?

   • ASupport for multiple simultaneous DNP3 masters to allow redundant SCADA servers.
   • BAbility to translate IEC 61850 GOOSE messages to DNP3 for fast event reporting.
   • CLocal data buffering and store-and-forward capability to handle communication outages.
   • DBuilt-in web server for remote configuration and monitoring.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is reviewing a packet capture from a network that uses both Modbus TCP and DNP3. The analyst notices that the Modbus TCP traffic is coming from a device that is not the known SCADA master, and the DNP3 traffic is coming from the same device. The device is sending Modbus write commands to a PLC and DNP3 control commands to an RTU. What should the analyst conclude?

   • AThe device is a new SCADA master that was recently added
   • BThe device is a test tool that is performing routine diagnostics
   • CThe device is a router that is forwarding traffic
   • DThe device is an attacker that has gained access to the network and is sending unauthorized commands
   Reveal Solution Discussion Select an answer first
6. 30expert · hard · select all that apply

   A security analyst is reviewing a pcap of Modbus TCP traffic and identifies the following anomalies: (1) a write request to a coil that is normally read-only, (2) a series of requests with function code 0x2B (read device identification) from an unknown IP, and (3) a burst of write requests to multiple holding registers with values that are out of the normal operating range. Which of the following are appropriate immediate actions? Select all that apply.

   • ADisable the Modbus TCP service on the PLC to prevent further writes.
   • BReview the PLC logic to verify whether the write to the read-only coil is legitimate.
   • CBlock the unknown IP address at the firewall.
   • DImmediately reboot the PLC to clear any malicious register values.
   • ECapture additional traffic to determine if the unknown IP is scanning for other devices.
   Check answers Discussion Select an answer first