Monitoring ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When interpreting an IDS alert in an ICS environment, what should an analyst consider first?

   • AThe vendor of the IDS
   • BThe number of alerts generated in the last hour
   • CThe potential impact on the physical process and safety
   • DThe alert's severity rating only
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which active data collection method is commonly used to retrieve device status and metrics from ICS equipment?

   • AFlow data export
   • BSNMP polling
   • CPassive network sniffing
   • DLog file analysis
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How can monitoring data support compliance with ICS security standards?

   • ABy eliminating the need for audits
   • BBy providing evidence of security controls and incident detection
   • CBy ensuring that all ICS devices are patched
   • DBy automatically generating compliance reports without any configuration
   Reveal Solution Discussion Select an answer first
5. 14expert · medium

   A large petrochemical facility has a monitoring architecture with multiple passive sensors sending full packet capture to a central SIEM. The SIEM is overwhelmed by the volume of data, causing delayed alerting. The security team must reduce the data volume while preserving the ability to detect complex multi-step attacks. Which approach is most appropriate?

   • ADisable all alerts except those for critical severity
   • BDeploy edge analytics at the sensors to extract only protocol-level metadata and alerts, and send those to the SIEM
   • CIncrease the SIEM's storage capacity and keep all raw packets
   • DReduce the packet capture rate by sampling only 1 in 10 packets
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is monitoring particularly important in ICS networks compared to traditional IT networks?

   • ABecause ICS networks do not generate logs or traffic data
   • BBecause ICS networks are always isolated from the internet
   • CBecause ICS environments prioritize availability and safety, and monitoring helps detect issues that could impact physical processes
   • DBecause ICS protocols are inherently secure and need less monitoring
   Reveal Solution Discussion Select an answer first