ICS/SCADA Protocols ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An engineer is troubleshooting a Modbus TCP network where a PLC occasionally fails to respond to polls from the HMI. The network uses a managed switch with QoS enabled. The engineer notices that during the failures, a large file transfer is occurring between two IT workstations on the same switch. What is the most likely cause?

   • AThe HMI is polling too frequently, overwhelming the PLC.
   • BThe PLC is rebooting due to a firmware bug.
   • CThe QoS configuration is not prioritizing Modbus TCP traffic over the file transfer.
   • DThe switch is blocking Modbus TCP because it is an industrial protocol.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An engineer is analyzing a packet capture from a DNP3 link between a master station and an RTU. The capture shows a sudden increase in unsolicited responses from the RTU, each containing a different object variation for the same point. What should the engineer suspect?

   • AThe RTU is experiencing a configuration change or a fault condition
   • BThe master station is polling the RTU too frequently
   • CThe RTU is using a different transport protocol
   • DThe link is being flooded with ARP requests
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A utility company is integrating a new renewable energy substation into its existing SCADA system. The substation uses IEC 61850 for protection and control, while the SCADA master communicates via DNP3. The integration team needs to pass status and measurement data from the substation to the SCADA master. What is the most appropriate approach?

   • AUse a protocol gateway that translates IEC 61850 to DNP3.
   • BReplace the IEC 61850 devices with DNP3-enabled devices.
   • CConfigure the SCADA master to speak IEC 61850 directly.
   • DRun both protocols on the same network without translation.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An analyst is reviewing a pcap from a DNP3 network. Under normal conditions, the master polls the outstation every 2 seconds. The capture shows a burst of unsolicited responses from the outstation, each with a different internal indication (IIN) flag set, followed by a series of write requests to the outstation's configuration object. What should the analyst flag as the highest-priority anomaly?

   • AThe outstation is broadcasting its configuration to all devices on the network.
   • BThe unsolicited responses with changing IIN flags indicate a possible device malfunction or tampering.
   • CThe write requests are encrypted, preventing the analyst from reading the configuration changes.
   • DThe master is polling too frequently, causing network congestion.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A water treatment plant uses a mix of legacy serial RTUs and newer Ethernet-enabled PLCs. The engineering team needs to integrate both into a single monitoring system while preserving the existing field wiring. Which protocol selection best meets this requirement?

   • AReplace all legacy RTUs with modern Ethernet-only PLCs running Modbus TCP.
   • BUse OPC UA exclusively on the Ethernet PLCs and ignore the serial RTUs.
   • CDeploy DNP3 over TCP/IP on the Ethernet PLCs and use a serial-to-Ethernet gateway for the legacy RTUs.
   • DRun Modbus RTU over the Ethernet network using a serial-to-Ethernet converter for all devices.
   Reveal Solution Discussion Select an answer first