Mitigating the Risk of Legacy Machines ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of a virtual patching technique?

   • AReplacing the hard drive with a solid-state drive
   • BInstalling a service pack from the vendor
   • CDeploying an intrusion prevention system (IPS) rule to block exploit traffic
   • DUpgrading the RAM to improve performance
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A manufacturing plant has a legacy PLC that communicates with a SCADA server using a proprietary protocol over Ethernet. The PLC has no logging or security features. The SCADA server is on a separate VLAN from the PLC. The security team wants to monitor the PLC for anomalous activity. Which approach is MOST appropriate?

   • ADeploy a network TAP on the Ethernet link between the PLC and the SCADA server and connect it to an IDS that can parse the proprietary protocol.
   • BConfigure the SCADA server to log all communication with the PLC and review the logs for anomalies.
   • CInstall a host-based agent on the PLC that monitors its network traffic and logs to a central server.
   • DEnable SNMP on the PLC and monitor its interface statistics for unusual traffic patterns.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of planning the lifecycle of legacy systems?

   • ATo ensure legacy systems run faster
   • BTo keep legacy systems in operation indefinitely
   • CTo reduce the cost of electricity for the data center
   • DTo reduce long-term security risk by eventually upgrading, replacing, or retiring them
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A mining company has a legacy control system that is critical to operations but is no longer supported by the vendor. The system has been stable for years, but the security team is concerned about increasing risk. Management wants to minimize operational disruption while planning for the future. Which lifecycle approach should the security team recommend?

   • AImplement a risk-based migration plan that prioritizes the most critical and vulnerable components for replacement, while applying compensating controls to the rest.
   • BUpgrade the legacy system's hardware components to extend its life without changing the software.
   • CImmediately decommission the legacy system and install a modern replacement during the next scheduled maintenance window.
   • DContinue operating the legacy system indefinitely and rely on the plant's air-gapped network to protect it.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A water utility has a legacy SCADA server running Windows Server 2003 with a known remote code execution vulnerability in its OPC interface. The server cannot be patched because the vendor is out of business. The utility has deployed a network IPS with virtual patching signatures for the vulnerability. What is the PRIMARY purpose of the virtual patching control in this scenario?

   • ATo replace the OPC interface with a newer, patched version that is compatible with the server.
   • BTo monitor the server for signs of exploitation and alert the security team.
   • CTo block exploit attempts targeting the known vulnerability without altering the legacy software.
   • DTo permanently fix the vulnerability in the OPC interface by modifying the server's configuration.
   Reveal Solution Discussion Select an answer first