Mitigating the Risk of Legacy Machines ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A natural gas pipeline company has a legacy SCADA server that is vulnerable to a known buffer overflow exploit. The vendor has not released a patch and will not support the server after next year. The security team wants to protect the server until it is replaced. Which virtual patching approach is most appropriate?

   • AApply a Microsoft security patch that addresses the vulnerability, even though it is not officially supported.
   • BDisable the server's network interface and use a serial connection for SCADA communications.
   • CUse a network TAP to monitor traffic and generate alerts when the exploit signature is seen.
   • DDeploy an intrusion prevention system (IPS) inline before the server and create a rule that blocks the exploit's signature.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is a primary security risk associated with legacy machines in ICS networks?

   • AThey have unpatched vulnerabilities due to lack of vendor support
   • BThey are too fast for modern security monitoring tools
   • CThey use too much memory for the network
   • DThey are always connected to the internet
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A transportation authority operates a legacy signaling system that is critical for safety. The system is end-of-life and cannot be patched. The authority has a limited budget and must maintain operations for at least five more years. They are considering three options: (1) replace the entire system now, (2) implement compensating controls and replace in five years, or (3) do nothing and hope for the best. Which option best balances risk and operational constraints?

   • AReplace the entire system now, even if it requires taking the signaling system offline for an extended period.
   • BUpgrade only the software components of the signaling system to a modern version, leaving the hardware unchanged.
   • CDo nothing and rely on the system's physical isolation and the fact that it has never been attacked.
   • DImplement compensating controls such as segmentation, monitoring, and virtual patching, and develop a phased replacement plan over the next five years.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A power generation plant has a legacy turbine control system running Windows 2000. The system is on a flat network with the plant's business LAN. The plant manager wants to reduce risk but has a very limited budget. The security team proposes two options: (1) deploy a network IPS with virtual patching for Windows 2000 vulnerabilities, or (2) create a VLAN for the legacy system and configure a firewall to allow only the necessary HMI traffic. The VLAN creation requires a network engineer for 2 days, while the IPS deployment requires purchasing a new appliance. Which option is the BEST use of the limited budget?

   • AOption 2 (VLAN segmentation with firewall) because it uses existing network equipment and reduces the attack surface.
   • BNeither option is worth the cost because the system will be replaced in the future.
   • CBoth options are equally cost-effective and should be implemented together.
   • DOption 1 (IPS with virtual patching) because it directly addresses the known Windows 2000 vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A chemical plant has a legacy control system running Windows XP that is connected to a business network with internet access. The plant has a limited budget and must choose between two projects: (1) deploying a network IPS with virtual patching for Windows XP vulnerabilities, or (2) creating a VLAN for the legacy system with a firewall. The VLAN creation requires a network engineer for 3 days, while the IPS requires purchasing a new appliance. The plant manager wants to reduce risk as quickly as possible. Which project should the plant choose?

   • AProject 1 (IPS) because it can be deployed faster than the VLAN.
   • BNeither project is worth the cost because the system will be replaced soon.
   • CProject 2 (VLAN) because it uses existing equipment and reduces the attack surface immediately.
   • DBoth projects are equally fast and should be implemented together.
   Reveal Solution Discussion Select an answer first