Monitoring ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A utility company has multiple OT sites that generate security logs. The SIEM team wants to centralize these logs for correlation and alerting. The OT network is connected to the corporate network via a VPN. What is the most important consideration when sending OT logs to the SIEM?

   • AEnsure the log forwarding is encrypted and that the SIEM can handle the volume without dropping events.
   • BUse a single log format for all devices to simplify parsing.
   • CSend logs in plaintext to reduce latency.
   • DOnly forward logs from the corporate firewall, not the OT devices.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS) in an ICS network?

   • AIDS uses signatures, while IPS uses only anomaly detection
   • BIDS is only used in IT networks, while IPS is only used in ICS
   • CIDS is deployed inline, while IPS is deployed out-of-band
   • DIDS is passive and alerts, while IPS is active and can block traffic
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In an ICS monitoring architecture, which component is responsible for collecting raw network traffic data?

   • ASIEM platform
   • BManagement console
   • CCorrelation engine
   • DSensor
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the first step in establishing a baseline for anomaly detection in an ICS network?

   • ADeploying an IPS to block anomalies
   • BConfiguring SIEM correlation rules
   • CCollecting normal network traffic data over a period of time
   • DSetting alert thresholds
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A power utility's DNP3 network has experienced a series of false positives from its IDS, overwhelming the security team. The IDS is configured with generic IT signatures. The team wants to reduce false positives while maintaining detection of genuine anomalies. What is the most effective first step?

   • ADisable all IDS alerts and rely on periodic manual review of packet captures.
   • BIncrease the IDS threshold for all alerts to the maximum level to suppress noise.
   • CMove the IDS to a different network segment where traffic is less noisy.
   • DReplace generic signatures with ICS-specific DNP3 protocol decoders and establish a baseline of normal DNP3 traffic patterns.
   Reveal Solution Discussion Select an answer first