Mitigating the Risk of Legacy Machines ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A manufacturing company has a legacy historian server that is accessed by engineers from the corporate network for reporting. The server runs an unsupported OS and cannot be patched. The security team wants to segment the historian from the corporate network while still allowing engineers to access it. Which approach best meets the requirement?

   • AMove the historian to the corporate network and rely on the corporate firewall to protect it.
   • BCreate a VPN tunnel directly from each engineer's computer to the historian.
   • CDisable the historian's network interface and have engineers access it via a local console.
   • DPlace the historian in a DMZ and require engineers to access it through a jump host with multi-factor authentication.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A chemical plant has a legacy DCS controller that is vulnerable to a known remote code execution exploit. The controller is in a segmented network, but the exploit uses a legitimate port that is required for normal operations. The security team cannot modify the controller's software and cannot block the port entirely. Which virtual patching strategy is most appropriate?

   • AApply a vendor-supplied micro-patch to the controller's firmware.
   • BBlock the port at the firewall and use a separate port for the controller's communications.
   • CUse a network TAP to monitor the port and alert when the exploit signature is seen.
   • DDeploy an inline IPS that uses deep packet inspection to block the specific exploit payload while allowing legitimate traffic on the same port.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A food and beverage plant has a legacy bottling line controller that uses a proprietary protocol over Ethernet. The controller has known vulnerabilities and cannot be patched. The plant has a flat network, and the security team has a limited budget. They need to reduce the risk of an attacker exploiting the controller from the corporate network. Which combination of controls is most cost-effective?

   • ADeploy a virtual patch on the corporate firewall to block the known exploit signatures.
   • BReplace the controller with a modern one that has built-in security features.
   • CInstall a host-based firewall on the controller and configure it to block all traffic except from the SCADA server.
   • DSegment the controller into a separate VLAN with a firewall that allows only the required protocol from the SCADA server, and deploy a network-based IDS to monitor the segment.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A refinery has a legacy DCS (Distributed Control System) running on Windows XP. The DCS controls critical processes and cannot be shut down for more than 2 hours. The vendor has announced end-of-life and will not provide patches. The security team has identified that the DCS has a known vulnerability in its OPC server. The team is considering three options: (1) deploy a network IPS with virtual patching, (2) segment the DCS onto a dedicated VLAN with a firewall, and (3) begin a replacement project. Which combination of options is the MOST effective strategy?

   • AOption 3 only, because replacement is the only permanent solution.
   • BOption 2 only, because segmentation reduces the attack surface.
   • COption 1 only, because virtual patching directly addresses the known vulnerability.
   • DOptions 1 and 2, because they provide defense-in-depth while the replacement project is planned.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a lack of modern security feature commonly found on legacy ICS machines?

   • ASupport for USB 3.0 devices
   • BSupport for encrypted communication protocols
   • CAbility to run multiple applications simultaneously
   • DAbility to display high-resolution graphics
   Reveal Solution Discussion Select an answer first