A manufacturing plant has a DNP3 network linking a control center to remote field RTUs. The security team is deploying an anomaly detection system. They have captured two weeks of network traffic during normal operations. Which baseline establishment method is most appropriate for detecting subtle command injection attacks?

Set static thresholds for the total number of DNP3 packets per minute based on the maximum observed during the two-week capture

Set a threshold of 10% deviation from the average packet rate and alert on any exceedance

Use a signature-based IDS with DNP3 rules and rely on known attack patterns

Build a behavioral baseline of DNP3 function codes, source-destination pairs, and timing patterns, then flag deviations

During a routine review of SIEM alerts, an analyst notices a series of Modbus write commands to a PLC's setpoint registers from an IP address that is not in the plant's asset inventory. The writes are incrementally changing the setpoint values. What is the most appropriate immediate response?

Isolate the affected PLC from the network and reset it to its last known good configuration

Acknowledge the alert, correlate it with other logs, and escalate to the incident response team while temporarily blocking the source IP

Ignore the alert because the writes are small and may be a maintenance activity

Block the source IP at the firewall and continue monitoring

A manufacturing plant has a historian that records OPC UA data from multiple production lines. The security team wants to detect if a production line's data is being read at an unusually high rate, which could indicate data exfiltration. What is the best approach?

Use a signature-based IDS to detect known OPC UA exploit patterns.

Set a global threshold for all OPC UA traffic and alert if total traffic exceeds it.

Manually review OPC UA logs weekly to spot unusual read patterns.

Establish a baseline of normal OPC UA read rates per production line and alert when the rate exceeds a set threshold.

EC-CouncilICS/SCADA Cybersecurity

Domain 6Objective 5

Monitoring ICSSCADA Practice Questions (Page 9)

Part of the Securing the ICS Network domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

10 Concepts in This Objective

ICS Network Monitoring Fundamentals
Monitoring Architecture and Components
Data Collection Methods
Protocol Analysis for ICS
Anomaly Detection Techniques
Intrusion Detection and Prevention in ICS
Security Information and Event Management (SIEM) Integration
Monitoring for Compliance and Auditing
Incident Response and Monitoring
Monitoring Performance and Optimization

Questions 41–45

41application · medium
A manufacturing plant has a DNP3 network linking a control center to remote field RTUs. The security team is deploying an anomaly detection system. They have captured two weeks of network traffic during normal operations. Which baseline establishment method is most appropriate for detecting subtle command injection attacks?
Select an answer first
42foundation · easy
Which anomaly detection technique involves setting a specific value that, when exceeded, triggers an alert?
Select an answer first
43application · medium
During a routine review of SIEM alerts, an analyst notices a series of Modbus write commands to a PLC's setpoint registers from an IP address that is not in the plant's asset inventory. The writes are incrementally changing the setpoint values. What is the most appropriate immediate response?
Select an answer first
44foundation · easy
Which component in an ICS monitoring architecture typically aggregates data from multiple sensors and forwards it to a central platform?
Select an answer first
45application · medium
A manufacturing plant has a historian that records OPC UA data from multiple production lines. The security team wants to detect if a production line's data is being read at an unusually high rate, which could indicate data exfiltration. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ICSSCADA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ICSSCADA” is a trademark of its owner, used for identification only.

Monitoring ICSSCADA Practice Questions (Page 9)

Questions 41–45

Which anomaly detection technique involves setting a specific value that, when exceeded, triggers an alert?

During a routine review of SIEM alerts, an analyst notices a series of Modbus write commands to a PLC's setpoint registers from an IP address that is not in the plant's asset inventory. The writes are incrementally changing the setpoint values. What is the most appropriate immediate response?

Which component in an ICS monitoring architecture typically aggregates data from multiple sensors and forwards it to a central platform?

A manufacturing plant has a historian that records OPC UA data from multiple production lines. The security team wants to detect if a production line's data is being read at an unusually high rate, which could indicate data exfiltration. What is the best approach?

Keep studying — Securing the ICS Network