A utility company is performing an inventory of its ICS assets. They find a legacy device that is running an embedded operating system and communicating via a proprietary protocol. The device is not listed in any vendor support documentation. What should the security team do first to assess the risk of this device?

Identify the device's make, model, firmware version, and communication role in the ICS network.

Replace the device with a modern equivalent to eliminate the risk.

Immediately disconnect the device from the network to prevent any potential attack.

Search the internet for known vulnerabilities associated with the device's protocol.

A power utility has a legacy RTU running an embedded OS that does not support any modern security agents. The RTU communicates via serial links to a master station, and the serial protocol has no authentication. The RTU is critical for grid stability and cannot be replaced for two years. Which monitoring approach is MOST appropriate to detect anomalous activity on this legacy RTU?

Deploy a passive network tap on the serial link and use a protocol-aware IDS to monitor for unexpected commands or data patterns.

Conduct manual physical inspections of the RTU every week to check for tampering or unauthorized connections.

Install a host-based intrusion detection system (HIDS) agent on the RTU to monitor file integrity and process activity.

Enable logging on the RTU and forward logs to a SIEM via a new Ethernet interface added to the device.

What is the purpose of applying compensating controls to legacy machines?

To mitigate risks without upgrading or replacing the system

To increase the processing speed of the legacy machine

To replace the legacy machine with a modern one

To remove the legacy machine from the network entirely

A natural gas pipeline company has a legacy RTU that communicates with a master station using a proprietary protocol over a serial link. The RTU has no logging or security features. The company wants to monitor the RTU for anomalies without disrupting the serial communication. Which approach is MOST appropriate?

Deploy a host-based agent on the RTU that monitors its serial port activity.

Replace the serial link with an Ethernet connection and deploy a network IDS on the new link.

Install a passive tap on the serial link and connect it to a protocol-aware IDS that can parse the proprietary protocol.

Configure the master station to log all commands sent to the RTU and review the logs for anomalies.

EC-CouncilICS/SCADA Cybersecurity

Domain 6Objective 6

Mitigating the Risk of Legacy Machines ICSSCADA Practice Questions (Page 5)

Part of the Securing the ICS Network domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 21–25

21application · medium
A utility company is performing an inventory of its ICS assets. They find a legacy device that is running an embedded operating system and communicating via a proprietary protocol. The device is not listed in any vendor support documentation. What should the security team do first to assess the risk of this device?
Select an answer first
22application · medium
A power utility has a legacy RTU running an embedded OS that does not support any modern security agents. The RTU communicates via serial links to a master station, and the serial protocol has no authentication. The RTU is critical for grid stability and cannot be replaced for two years. Which monitoring approach is MOST appropriate to detect anomalous activity on this legacy RTU?
Select an answer first
23foundation · easy
What is the purpose of applying compensating controls to legacy machines?
Select an answer first
24application · medium
A natural gas pipeline company has a legacy RTU that communicates with a master station using a proprietary protocol over a serial link. The RTU has no logging or security features. The company wants to monitor the RTU for anomalies without disrupting the serial communication. Which approach is MOST appropriate?
Select an answer first
25foundation · easy
Which of the following is a common operating system found on legacy machines in ICS networks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.

Mitigating the Risk of Legacy Machines ICSSCADA Practice Questions (Page 5)

Questions 21–25

What is the purpose of applying compensating controls to legacy machines?

Which of the following is a common operating system found on legacy machines in ICS networks?

Keep studying — Securing the ICS Network