Mitigating the Risk of Legacy Machines ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which detection mechanism is commonly used to monitor legacy systems for intrusions?

   • AHost-based intrusion detection system (HIDS)
   • BDefragmenting the hard drive
   • COverclocking the CPU
   • DIncreasing the screen resolution
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A food processing plant has a legacy PLC that controls the bottling line. The PLC runs a proprietary real-time OS and communicates via a proprietary protocol over Ethernet. The PLC has known unpatched vulnerabilities, but the vendor has announced end-of-life and will not provide patches. The plant has a strict production schedule and cannot afford a full line shutdown for more than 4 hours. A replacement PLC is available but requires rewiring and re-engineering of the control logic, estimated at 3 weeks. The plant manager wants to reduce risk immediately. Which strategy BEST balances immediate risk reduction with the long-term need to eliminate the legacy system?

   • AImmediately schedule the replacement project and, in the interim, isolate the PLC in a dedicated VLAN with a firewall that only allows the HMI and engineering workstation to communicate with it.
   • BApply a host-based firewall on the PLC and enable all available logging features to monitor for anomalies.
   • CRetire the PLC immediately and use a manual backup process for the bottling line until the replacement is installed.
   • DDeploy a virtual patching IPS in front of the PLC and continue operations indefinitely without a replacement plan.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A refinery has a legacy distributed control system (DCS) that is vulnerable to a known exploit that uses a specific sequence of packets on a port that is also used for legitimate DCS communications. The security team cannot patch the DCS and cannot block the port. They have deployed an inline IPS. What should the IPS rule do to effectively virtual patch the vulnerability?

   • ARate-limit traffic on the port to slow down potential exploit attempts.
   • BLog all traffic on the port and alert the security team when the exploit signature is seen.
   • CBlock any packet that matches the exploit's signature, while allowing other traffic on the same port.
   • DBlock all traffic on the port and require the DCS to use a different port.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A regional water utility operates a legacy SCADA system that includes a Windows NT-based HMI and a PLC network. The HMI is connected to both the corporate IT network (for business reporting) and the PLC network. The HMI cannot be patched or replaced for 18 months. The utility has a limited budget and cannot afford a full network redesign. Which combination of compensating controls would most effectively reduce the risk posed by the HMI?

   • AInstall a host-based firewall on the HMI and enable logging to a central SIEM.
   • BUpgrade the HMI's operating system to a modern version and apply all security patches.
   • CPlace the HMI in a DMZ between the corporate and PLC networks, with a stateful firewall allowing only the required protocols, and deploy a network-based IDS to monitor traffic to and from the HMI.
   • DDisconnect the HMI from the corporate network and have operators manually transfer reports via USB drives.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A power utility has a legacy remote terminal unit (RTU) that communicates using a proprietary protocol over a serial link to a master station. The RTU's firmware is outdated and cannot be updated. Which risk assessment factor is most critical to consider when evaluating the RTU's exposure?

   • AThe proprietary protocol's lack of authentication and encryption, which could allow spoofing or tampering.
   • BThe number of technicians trained to maintain the RTU.
   • CThe age of the RTU hardware and its expected remaining service life.
   • DThe RTU's physical location and whether it is in a locked cabinet.
   Reveal Solution Discussion Select an answer first