ICS/SCADA Protocols ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following anomalies in ICS/SCADA protocol traffic should raise a security concern?

   • AA master device polling a slave device every 10 seconds as configured
   • BA sudden increase in write commands to a controller from an unexpected IP address
   • CA scheduled firmware update from the vendor's maintenance laptop
   • DA slave device responding to a poll request with a valid data packet
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which protocol is specifically designed for electric utility SCADA systems and supports robust data transfer, event reporting, and peer-to-peer communication?

   • AModbus
   • BPROFIBUS
   • CDNP3
   • DOPC DA
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An analyst is reviewing a pcap from a DNP3 network and sees a master sending a 'Delay Measurement' request to an outstation. The outstation responds with a 'Delay Measurement' response, but the response contains an unexpected 'IIN' bit indicating 'Function Code Not Supported'. The analyst also notices that the master is sending the request repeatedly every 100 ms. What is the most likely cause?

   • AThe outstation does not support the Delay Measurement function, and the master is retrying because it is not handling the error response correctly.
   • BThe master is configured to poll too frequently, overwhelming the outstation.
   • CThe network is congested, causing the response to be delayed and the master to retry.
   • DThe outstation is under a denial-of-service attack, causing it to reject all requests.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An analyst is examining a pcap from a mixed network that includes both Modbus TCP and DNP3 traffic. The analyst notices that the Modbus TCP traffic shows a normal polling pattern, but the DNP3 traffic shows an unusually high rate of unsolicited responses from a single outstation. The analyst also sees that the DNP3 master is sending 'Disable Unsolicited' messages to that outstation, but the outstation continues to send unsolicited responses. What is the most likely cause?

   • AThe master is not configured to receive unsolicited responses, so it is sending disable commands.
   • BThe DNP3 protocol does not support disabling unsolicited responses.
   • CThe network is congested, causing the unsolicited responses to be delayed and appear as a burst.
   • DThe outstation is malfunctioning or has been compromised to ignore the disable command.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A manufacturing company is integrating its OT network with the corporate IT network to allow real-time production monitoring. The OT network uses a mix of Modbus TCP and DNP3, while the IT network uses standard IT protocols. The security team is concerned about the inherent vulnerabilities of ICS protocols. What is the most effective way to mitigate the risk of unauthorized access to the OT network while still allowing the required data flow?

   • ADeploy a firewall with strict allow-list rules between the IT and OT networks
   • BReplace all ICS protocols with IT protocols
   • CImplement encryption on all ICS protocols
   • DDisable all ICS protocols and use a read-only historian
   Reveal Solution Discussion Select an answer first