Monitoring ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When analyzing DNP3 traffic for monitoring, what is a key characteristic that distinguishes it from Modbus?

   • ADNP3 does not use any form of addressing
   • BDNP3 is a proprietary protocol owned by a single vendor
   • CDNP3 supports unsolicited responses from outstation devices
   • DDNP3 is only used over serial connections
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is examining a packet capture from a Modbus TCP network and sees a series of function code 16 (write multiple registers) requests to a PLC from an IP address that is not in the list of authorized engineering workstations. What should the analyst do first?

   • AImmediately block the source IP at the firewall.
   • BIgnore the traffic because Modbus write operations are common.
   • CVerify the source IP against the asset inventory and check if the write operation matches a scheduled maintenance activity.
   • DReboot the PLC to clear any potential malicious state.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which data collection method is considered passive because it does not send traffic into the ICS network?

   • APort scanning
   • BNetwork tap or SPAN port monitoring
   • CActive vulnerability scanning
   • DSNMP polling
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A chemical plant is designing a new ICS monitoring architecture. They need to collect network traffic from multiple control segments and forward it to a central security operations center (SOC). Which architecture component is essential to aggregate data from multiple sensors before sending it to the SOC?

   • AA VPN concentrator to connect the SOC to the control network.
   • BA central collector or aggregator that receives data from all sensors and forwards normalized events to the SOC.
   • CA separate management console for each sensor.
   • DA firewall that filters all traffic between the control segments and the SOC.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the first step in using monitoring outputs to respond to a security incident in an ICS network?

   • ARecover systems to normal operation
   • BContain the incident by isolating affected systems
   • CDetect the incident through monitoring alerts and logs
   • DEradicate the threat by removing malware
   Reveal Solution Discussion Select an answer first