Monitoring ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst is reviewing a packet capture from a DNP3 network and notices a series of unsolicited responses from a remote outstation to the master station. The analyst wants to determine if this is normal behavior. What should the analyst do?

   • AIgnore the traffic because DNP3 unsolicited responses are always normal.
   • BCheck the DNP3 source address to see if it matches the expected outstation's configured address.
   • CCompare the unsolicited response pattern against a baseline of historical DNP3 traffic to see if such messages are routine.
   • DImmediately block the outstation's IP address at the firewall.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A power utility wants to monitor DNP3 traffic on a network segment that uses a managed switch. The switch supports port mirroring. The security team needs to capture traffic without affecting the control network. What is the most appropriate data collection method?

   • AInstall an active tap that breaks the connection and re-inserts the sensor inline.
   • BConfigure port mirroring on the switch to send a copy of DNP3 traffic to a monitoring sensor.
   • CDeploy a software agent on each PLC to capture and forward DNP3 traffic.
   • DUse the switch's SNMP agent to collect DNP3 packet details.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A chemical plant's monitoring system uses a central collector that polls SNMP agents on 500 field devices every 30 seconds. The collector's CPU is consistently at 95% utilization, and some polls time out. The plant cannot add hardware. Which optimization is most appropriate?

   • AEnable SNMP traps and configure the collector to receive asynchronous notifications instead of polling every device
   • BDisable SNMP polling for devices that have not changed in the last 24 hours
   • CMove the collector to a virtual machine with more vCPUs
   • DIncrease the polling interval to 5 minutes for all devices
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An ICS monitoring team has deployed multiple IDS sensors across a large facility. The central management console is overwhelmed by the volume of alerts, causing delays in alert processing. The team needs to reduce the load while ensuring critical alerts are not missed. Which approach is most effective?

   • AIncrease the console's hardware resources to handle the alert volume.
   • BDisable all low-priority alerts on the sensors.
   • CImplement alert deduplication and correlation rules on the sensors to forward only unique, high-priority events to the console.
   • DReduce the number of sensors to decrease alert volume.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which practice helps ensure that an ICS monitoring system can handle high traffic volumes without dropping data?

   • AReducing the number of monitored devices
   • BDisabling packet capture on busy segments
   • CScaling monitoring infrastructure and using load balancing
   • DIncreasing alert thresholds to reduce data collection
   Reveal Solution Discussion Select an answer first