Monitoring ICSSCADA Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the primary purpose of network monitoring in an ICS environment?

   • ATo replace the need for physical security controls
   • BTo automatically block all unauthorized traffic without human intervention
   • CTo provide visibility into network activity for security and operational awareness
   • DTo ensure that all ICS devices are running the latest firmware
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A manufacturing company must integrate monitoring data from multiple OT sensors, PLC syslogs, and a network IDS into a central SIEM for compliance auditing. The OT network is isolated and has limited bandwidth. Which integration approach is most appropriate?

   • AConfigure each sensor to send raw syslog directly to the SIEM over the corporate WAN.
   • BExport IDS alerts to a CSV file and manually upload them to the SIEM weekly.
   • CHave the SIEM actively poll each PLC's memory registers over the OT network.
   • DDeploy a log collector on the OT network that forwards normalized and filtered events to the SIEM over a one-way data diode.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A water distribution system uses OPC UA for communication between a historian and several PLCs. The security team wants to detect unusual read/write patterns that might indicate a cyber threat. They have collected two weeks of baseline traffic. What is the most effective anomaly detection technique to apply?

   • AManually review all OPC UA traffic logs at the end of each day.
   • BCreate a statistical model of normal OPC UA read/write frequencies and alert on deviations beyond a defined threshold.
   • CSet a static threshold for the total number of OPC UA packets per hour and alert if exceeded.
   • DUse a signature-based IDS to match known OPC UA exploit patterns.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A pharmaceutical company must demonstrate to an auditor that its ICS monitoring system meets the requirements of a security standard. The company has a SIEM that collects logs from firewalls, IDS, and PLCs. What is the most important step to ensure the SIEM data supports compliance auditing?

   • AConfigure the SIEM to automatically delete logs older than 30 days to save storage.
   • BAdd more IDS sensors to the network to increase the volume of alerts.
   • CUse the SIEM to generate daily reports of all network traffic volumes.
   • DEnsure the SIEM retains logs for the required retention period and that timestamps are synchronized across all sources.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A water treatment facility uses Modbus TCP between a SCADA server and remote PLCs. The security team wants to detect unauthorized register writes without disrupting operations. They have deployed a network tap on the SCADA server's switch port. Which monitoring approach best achieves this goal?

   • ADeploy an IPS inline between the SCADA server and the switch to block any Modbus write function code.
   • BCollect syslogs from the SCADA server and search for 'write' events after an incident is reported.
   • CEnable passive protocol parsing on the tap to decode Modbus function codes and alert on write commands (FC 5, 6, 15, 16) to unexpected registers.
   • DConfigure an active scanner to periodically poll each PLC's register map and compare against a baseline of allowed values.
   Reveal Solution Discussion Select an answer first