Monitoring ICSSCADA Practice Questions (Page 11)

Questions 51–52

1. 51expert · hard

   An ICS security team has deployed a network-based monitoring sensor on a critical control segment. The sensor is generating high CPU usage and occasionally dropping packets during peak production. The team must maintain full visibility without impacting control traffic. Which action should they take first?

   • ATune the sensor's capture filters to exclude non-essential broadcast and multicast traffic while retaining all ICS protocol traffic.
   • BReplace the sensor with a higher-end appliance that has more CPU and memory.
   • CIncrease the sensor's buffer size to prevent packet drops without changing filters.
   • DMove the sensor to a different switch port that receives less traffic.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A power utility is deploying an IDS to monitor DNP3 traffic between a master station and substation RTUs. The IDS must detect unauthorized control commands while avoiding disruption to critical operations. Which deployment mode and rule configuration is most appropriate?

   • AInline IPS with a default-deny policy that blocks any DNP3 function code not explicitly allowed
   • BPassive IDS with a rule that only alerts on malformed DNP3 packets
   • CInline IPS with a rule that drops all DNP3 writes during non-maintenance hours
   • DPassive IDS on a SPAN port with rules that alert on DNP3 function codes from unexpected sources or to unexpected destinations
   Reveal Solution Discussion Select an answer first