Monitoring ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A refinery uses OPC UA for communication between historians and control systems. The security team wants to monitor for unauthorized reads of process data without affecting the OPC UA server's performance. Which data collection method is most appropriate?

   • ADeploy a passive network sensor on a mirror port to capture and parse OPC UA traffic
   • BUse an active scanner to periodically query the OPC UA server's address space and compare against a baseline
   • CConfigure the OPC UA server to mirror all read requests to a second historian
   • DEnable OPC UA server-side auditing to log all read operations
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A municipal water utility has deployed a SIEM and is ingesting logs from its ICS network sensors, Active Directory, and firewall. The security team wants to detect a potential cyber attack that involves an attacker using a compromised operator workstation to send unauthorized commands to a PLC. Which SIEM correlation rule is most effective?

   • AAlert when the workstation sends any traffic to the PLC during non-business hours
   • BAlert when a single firewall log shows a connection from the workstation to the PLC
   • CAlert when a Modbus write command is seen from the workstation to the PLC and the workstation's Active Directory account has not logged in recently
   • DAlert when the firewall blocks a connection from the workstation to the PLC
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How can monitoring data help in mitigating the impact of an ongoing ICS security incident?

   • ABy resetting all user passwords
   • BBy providing real-time visibility into the attacker's actions and affected systems
   • CBy automatically patching vulnerabilities
   • DBy deleting malicious files from endpoints
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a key consideration when deploying monitoring sensors in an ICS network to minimize operational impact?

   • APlacing sensors inline with all critical traffic
   • BDeploying sensors out-of-band using passive taps or SPAN ports
   • CDisabling logging to reduce overhead
   • DUsing active scanning as the primary collection method
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A food processing plant uses EtherNet/IP for its packaging line. The security team has deployed an anomaly detection system that monitors network traffic. During a normal production run, the system generates frequent alerts for 'unexpected EtherNet/IP command' because a maintenance laptop is occasionally connected to the network. What is the best way to reduce false positives while maintaining security?

   • AIncrease the alert threshold so that only commands from unknown IP addresses trigger alerts
   • BDisable alerts for the maintenance laptop's IP address entirely
   • CSwitch to a signature-based IDS that only alerts on known EtherNet/IP exploits
   • DCreate a baseline that includes the maintenance laptop's known activity patterns and adjust the anomaly detection threshold accordingly
   Reveal Solution Discussion Select an answer first