Mitigating the Risk of Legacy Machines ICSSCADA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A hospital has a legacy building automation system (BAS) that controls HVAC and is connected to the IT network for remote monitoring. The BAS controller runs an outdated firmware with known vulnerabilities. The hospital wants to isolate the BAS from the IT network but still allow the facilities team to monitor and adjust settings remotely. Which segmentation approach is most appropriate?

   • ADisable remote access and require facilities staff to physically go to the controller room to make adjustments.
   • BPlace the BAS controller in a separate VLAN and require facilities staff to access it through a jump host with multi-factor authentication.
   • CConnect the BAS controller directly to the IT network but restrict access using the controller's built-in user accounts.
   • DUse a VPN concentrator to allow facilities staff to connect directly to the BAS controller from their laptops.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a lifecycle strategy for a legacy system?

   • AIncreasing the system's memory
   • BChanging the system's IP address
   • CAdding a second monitor
   • DRetiring the system and decommissioning it
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A wastewater plant has a legacy SCADA server running Windows Server 2003 with a known critical vulnerability in its web interface. The server is in a DMZ that is accessible from the corporate network. The vendor is out of business, and a replacement is planned in 12 months. The plant has deployed a network IPS with virtual patching signatures for the vulnerability. However, the IPS is placed at the DMZ boundary, and the corporate network can still reach the SCADA server directly. What is the MOST significant remaining risk that the virtual patching does NOT address?

   • AThe SCADA server's web interface may have a different vulnerability that is not in the IPS signature database.
   • BThe virtual patching IPS may have a signature bypass, allowing a crafted exploit to reach the vulnerable web interface.
   • CThe Windows Server 2003 operating system has other unpatched vulnerabilities that are not covered by the virtual patching signatures.
   • DThe corporate network can still reach the SCADA server directly, so a compromised corporate workstation can exploit the vulnerability before the traffic reaches the IPS.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A water treatment facility has a 15-year-old HMI running Windows XP that communicates with a PLC over a flat network. The HMI cannot be patched or replaced this quarter. The security team needs to reduce the risk of a remote attacker exploiting the HMI's known vulnerabilities while keeping the HMI functional. Which approach best addresses the immediate risk?

   • AInstall a modern antivirus product on the HMI and enable automatic signature updates over the corporate network.
   • BDisconnect the HMI from the network and have operators use a serial console to interact with the PLC.
   • CPlace the HMI and PLC in a dedicated VLAN with a stateful firewall rule allowing only the required HMI-to-PLC protocol, and block all other traffic to the HMI.
   • DApply a host-based intrusion prevention system (HIPS) on the HMI and configure it to block all inbound traffic except from the PLC.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A manufacturing plant has a legacy CNC machine controller running Windows NT 4.0. The controller is critical for production and cannot be replaced for 18 months. The plant has a limited budget and must choose between two risk-reduction projects: (1) deploying a network IPS with virtual patching for known Windows NT vulnerabilities, or (2) segmenting the controller onto a dedicated VLAN with a firewall. The controller is currently on the same network as the plant's engineering workstations, which have internet access. Which project should the plant prioritize, and why?

   • ABoth projects are equally important and should be implemented simultaneously.
   • BProject 2 (VLAN segmentation with firewall) because it reduces the attack surface by isolating the controller from the internet-connected engineering network.
   • CNeither project is worth the cost because the controller will be replaced in 18 months.
   • DProject 1 (IPS with virtual patching) because it directly addresses the known vulnerabilities in Windows NT 4.0.
   Reveal Solution Discussion Select an answer first