Monitoring ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   During a routine shift, a SIEM alert fires indicating a series of failed login attempts to a historian server, followed by a successful login from an unusual IP address. The ICS network is segmented, and the historian is in a DMZ. The incident response team must act quickly. What is the most appropriate immediate response?

   • AChange the historian's password and continue monitoring for further anomalies.
   • BIgnore the alert because the login was successful and the IP is in the DMZ.
   • CIsolate the historian server from the network while preserving forensic evidence and begin investigating the source IP.
   • DShut down the entire ICS network to prevent further damage.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What type of monitoring data is most useful for auditing user access to ICS systems?

   • AAuthentication and authorization logs
   • BFirmware version information
   • CNetwork traffic captures
   • DEnvironmental sensor readings
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An auditor requires evidence that all changes to a PLC's configuration were reviewed and approved. The company uses a SIEM that collects syslogs from the engineering workstation. What additional monitoring data would best support this audit requirement?

   • ACollect and correlate change-management records with SIEM logs of engineering workstation activity.
   • BStore raw packet captures of all PLC traffic for one year.
   • CUse the SIEM to generate a monthly report of all PLC IP addresses.
   • DEnable SNMP traps on the PLC to report configuration changes directly to the SIEM.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which SIEM feature is used to identify relationships between seemingly unrelated events from different sources?

   • ACorrelation rules
   • BLog rotation
   • CData deduplication
   • DSyslog forwarding
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A water treatment plant uses Modbus TCP between a SCADA master and several PLCs. The security team recently deployed a passive network tap on the switch mirror port that carries the Modbus traffic. They want to detect unauthorized writes to the PLC holding registers. Which monitoring approach is most appropriate?

   • ADeploy an active scanner to poll each PLC's register map every 5 minutes and compare against a baseline
   • BUse an IPS in inline mode to block all Modbus traffic that does not match a pre-approved allowlist of function codes
   • CConfigure the passive sensor to parse Modbus function codes and alert when a write function (e.g., 0x06 or 0x10) is seen from an unexpected source IP
   • DEnable NetFlow on the switch and analyze flow records for large data transfers to the PLCs
   Reveal Solution Discussion Select an answer first