Mitigating the Risk of Legacy Machines ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A food processing plant has a legacy Windows 2000-based OPC server that cannot be patched. The security team has implemented network segmentation and a firewall. They now need to detect if an attacker is attempting to exploit the OPC server's known vulnerabilities. Which monitoring approach is most appropriate for this legacy environment?

   • ADeploy a network-based intrusion detection system (NIDS) on the segmented network segment to monitor for exploit signatures and anomalous OPC traffic.
   • BInstall a host-based intrusion detection system (HIDS) on the OPC server and configure it to log all file access.
   • CEnable Windows auditing on the OPC server to log all successful and failed logon attempts.
   • DUse a protocol analyzer to capture all traffic on the segment and review it manually once a week.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of a compensating control for a legacy machine?

   • AInstalling a host-based firewall on the legacy machine
   • BDisabling the network interface of the legacy machine
   • CReplacing the legacy machine with a new one
   • DUpgrading the operating system to the latest version
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why is monitoring legacy systems important in an ICS network?

   • ATo automatically update the operating system
   • BTo detect anomalous activity that may indicate a security breach
   • CTo increase the processing speed of the legacy system
   • DTo replace the legacy system with a modern one
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A chemical plant has a legacy DCS that is no longer supported by the vendor. The system is stable but has known unpatched vulnerabilities. The plant's management wants to reduce long-term risk while maintaining production. Which lifecycle strategy should the security team recommend?

   • AUpgrade only the operating system on the DCS workstations while keeping the DCS controllers unchanged.
   • BDevelop a multi-year migration plan to a supported DCS, while applying compensating controls and monitoring in the interim.
   • CContinue operating the DCS without changes and rely on the plant's physical security to prevent attacks.
   • DImmediately retire the DCS and replace it with a modern system, regardless of production impact.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An ICS security auditor is reviewing a legacy system inventory and finds a Windows NT 4.0 server running a database that is no longer supported. The server is connected to the corporate network and has not been patched in years. Which risk is the MOST critical to document for this server?

   • AThe server's database software is no longer supported, so it may have compatibility issues with other applications.
   • BThe server's hardware is old and may fail, causing downtime.
   • CThe server's operating system has known unpatched vulnerabilities that can be exploited remotely.
   • DThe server's location on the corporate network makes it difficult to monitor for anomalies.
   Reveal Solution Discussion Select an answer first