Mitigating the Risk of Legacy Machines ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is virtual patching?

   • AA technique that applies security updates to the operating system
   • BA process of deleting unused files from the system
   • CA security control that mitigates vulnerabilities without modifying the original software
   • DA method to replace legacy hardware with virtual machines
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A water utility has a legacy SCADA system that is segmented from the corporate network. The system has no host-based monitoring capabilities. The security team has deployed a network-based IDS (NIDS) on the SCADA segment. They want to detect a sophisticated attacker who is using encrypted communications to hide their activity. Which additional monitoring technique would be most effective?

   • AInstall a host-based agent on the SCADA servers to monitor for malicious activity.
   • BDisable encryption on the SCADA network to allow the NIDS to inspect the traffic.
   • CUse the NIDS to monitor for anomalous traffic patterns, such as unusual connection durations or data volumes, even if the content is encrypted.
   • DDeploy a network tap and use deep packet inspection to decrypt and analyze the encrypted traffic.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A manufacturing plant runs a legacy SCADA server on Windows Server 2003 that has a known remote code execution vulnerability. The vendor no longer provides patches, and the server cannot be taken offline. The security team wants to mitigate the vulnerability without modifying the server's software. Which technique should they use?

   • AConfigure the server to disable the vulnerable service and rely on application whitelisting.
   • BUpgrade the server to a newer version of Windows Server that is still supported.
   • CImplement a virtual patch using an IPS or firewall rule that blocks the specific exploit traffic pattern.
   • DDeploy an intrusion detection system (IDS) on the network to alert on exploit attempts.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An energy company has a legacy substation RTU that communicates with a central SCADA system over an IP network. The RTU runs an outdated firmware with known vulnerabilities. The company wants to isolate the RTU from the corporate network while still allowing the SCADA system to poll it. What is the most effective network segmentation approach?

   • AConnect the RTU directly to the corporate network but restrict access using host-based firewall rules on the RTU.
   • BUse a serial-to-Ethernet converter and place the RTU on a separate serial link with no IP connectivity.
   • CPlace the RTU in a separate VLAN with a firewall rule that permits only the SCADA system's IP address and the specific polling protocol.
   • DImplement network address translation (NAT) to hide the RTU's IP address from the corporate network.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A water treatment facility has a 15-year-old SCADA server running Windows NT 4.0 that controls the chlorine dosing process. The server cannot be patched or upgraded without a full plant shutdown, which is not approved until next year. The server must remain accessible to the engineering workstation subnet for HMI display and alarm acknowledgment. The ICS network is already isolated from the corporate network by a firewall. What is the MOST effective immediate control to reduce the risk of a remote attacker exploiting the unpatched server?

   • APlace the legacy server in a dedicated VLAN with a stateful firewall that allows only the specific HMI protocol (e.g., Modbus TCP on port 502) from the engineering subnet to the server.
   • BCreate a firewall rule on the ICS boundary firewall that permits only the engineering workstation subnet to reach the legacy server on TCP port 3389.
   • CDeploy an application whitelisting agent on the legacy server to block unauthorized executables.
   • DInstall a host-based intrusion detection system (HIDS) on the server and configure alerts for any new listening ports.
   Reveal Solution Discussion Select an answer first