Monitoring ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An ICS security team detects a suspected malware infection on a control server. The malware appears to be communicating with an external IP address. The team must respond while minimizing operational impact. Which action should they take first?

   • AImmediately shut down the affected server to stop the malware.
   • BDisconnect the entire control network from the corporate network.
   • CBlock outbound communication from the affected server to the external IP at the firewall while preserving the server's local functionality.
   • DIgnore the communication because the server is still functioning normally.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which ICS protocol is a master-slave protocol commonly used in industrial control systems and operates over serial or Ethernet?

   • AHTTP
   • BDNS
   • CFTP
   • DModbus
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the main benefit of integrating ICS monitoring data into a SIEM platform?

   • AIt provides centralized log management and correlation across IT and OT
   • BIt automatically patches all ICS vulnerabilities
   • CIt eliminates the need for any other security tools
   • DIt replaces the need for network monitoring sensors
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A mining company has a wireless mesh network connecting mobile equipment to a control center. The network is subject to intermittent packet loss and variable latency. The security team is deploying an anomaly detection system that uses a baseline of network traffic. Which baseline approach is most robust to the network's variability?

   • AUse a fixed threshold for packet rates based on a single 24-hour capture
   • BSet thresholds to the maximum observed values to avoid false positives
   • CEstablish a baseline using statistical models that account for time-of-day and environmental factors, and update it periodically
   • DDisable anomaly detection during periods of high packet loss
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A small water utility has no dedicated security staff and relies on the SCADA administrator to monitor the ICS network. The administrator wants to improve security visibility without adding significant workload. Which monitoring approach is most practical?

   • AInstall a full SIEM and hire a dedicated security analyst to manage it.
   • BDisable monitoring because the network is small and isolated.
   • CDeploy a simple network-based monitoring tool that sends email alerts for predefined anomalies, such as new devices appearing on the network.
   • DRequire the administrator to manually review all firewall logs every morning.
   Reveal Solution Discussion Select an answer first