Monitoring ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A natural gas pipeline operator must demonstrate compliance with NERC CIP requirements for change monitoring on its ICS network. They have deployed a SIEM that collects logs from network sensors and host agents. What is the most effective way to use this data for an audit?

   • AStore raw packet captures for all network traffic for one year without any indexing
   • BGenerate a monthly report showing the total volume of logs collected per device
   • CCreate a SIEM dashboard that shows all configuration changes, user access events, and network alerts with timestamps and user attribution, and retain it for the required period
   • DConfigure the SIEM to automatically delete logs older than 30 days to reduce storage costs
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A regional electrical cooperative is designing a monitoring architecture for its distribution automation network. They need to collect data from multiple substations and centralize it for analysis. Which architecture is most appropriate for scalability and resilience?

   • AUse a peer-to-peer mesh where each substation sends data directly to every other substation
   • BDeploy a single collector at the central control center that polls all substation devices directly
   • CPlace a local collector at each substation that aggregates data and forwards it to a central management console
   • DStore all data only at each substation and have analysts travel to retrieve it
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A hospital's building automation system (BAS) uses BACnet/IP. The security team is integrating monitoring data into a SIEM for centralized log management and compliance auditing. Which integration approach is most effective for correlating BAS events with network anomalies?

   • ASend only BACnet application-layer logs from the BAS controller to the SIEM via syslog
   • BDeploy a protocol-aware sensor that generates BACnet-specific events and sends them to the SIEM alongside network flow records
   • CConfigure the SIEM to poll the BAS controller's log buffer every hour using BACnet's proprietary API
   • DForward network flow records from the BAS VLAN to the SIEM, but do not include BACnet protocol details
   Reveal Solution Discussion Select an answer first
5. 39expert · medium

   A regional transmission operator is required to retain monitoring logs for 18 months for compliance, but the SIEM storage budget only supports 6 months of full log retention. The security team must meet compliance without exceeding the budget. Which approach is most appropriate?

   • ANegotiate with the regulator to reduce the retention period to 6 months
   • BStore full logs for 6 months and then aggregate summaries for the remaining 12 months
   • CUse a tiered storage approach: keep full logs on fast storage for 6 months, then move them to lower-cost archival storage for the remaining 12 months
   • DRetain only security alert logs for 18 months and discard other logs
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A natural gas pipeline operator wants to monitor for unauthorized Modbus commands on a legacy serial link between a master station and a remote terminal unit (RTU). The link has no spare ports and cannot be taken offline. Which data collection method is most suitable?

   • AUse a passive serial tap or splitter to mirror the traffic to a monitoring device.
   • BEnable SNMP on the RTU to report Modbus traffic statistics.
   • CDeploy an active proxy between the master and RTU to inspect and log all commands.
   • DConfigure the RTU to send periodic status reports to the monitoring system.
   Reveal Solution Discussion Select an answer first