Securing the Protocols Unique to the ICS ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A chemical plant uses OPC DA (Data Access) between a DCS and a reporting server. The security team wants to protect the data from being tampered with during transmission. The OPC DA protocol does not support encryption. Which solution is most appropriate?

   • APlace both systems on a dedicated VLAN and use an IPsec tunnel between the DCS and the reporting server.
   • BEnable DCOM packet privacy on the OPC DA server.
   • CUpgrade the OPC DA server to use OPC UA with the None security policy.
   • DUse a serial connection instead of Ethernet because serial is inherently secure.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A utility has a legacy DNP3 network without Secure Authentication. The security team wants to add a control that can detect and block unauthorized commands without upgrading the outstations. Which control is most effective?

   • AUse a standard firewall that filters based on IP addresses and ports.
   • BDeploy an inline industrial firewall that inspects DNP3 function codes and blocks unauthorized write commands.
   • CDeploy a passive IDS that alerts on suspicious DNP3 traffic.
   • DUpgrade the outstations to support DNP3 Secure Authentication.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a common vulnerability in DNP3 that allows an attacker to inject false data into the SCADA system?

   • ADNP3 uses a broadcast addressing scheme that allows any device to send commands to any other device
   • BThe protocol uses a fixed 16-bit CRC for error checking, which is not cryptographically secure
   • CDNP3 is a proprietary protocol that cannot be inspected by security tools
   • DDNP3 requires the use of a public key infrastructure (PKI) for all communications
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A natural gas pipeline uses Modbus RTU over serial links between a central SCADA server and remote terminal units (RTUs). The serial links are in unsecured cabinets. The security team wants to prevent an attacker from injecting false commands. Which control is most appropriate?

   • AImplement message authentication at the application layer, such as a CRC plus a secret key, and physically secure the cabinets.
   • BSwitch to Modbus TCP and rely on the network firewall to block unauthorized access.
   • CUse DNP3 without Secure Authentication because it is inherently secure.
   • DDisable the CRC check in Modbus RTU to reduce processing delay.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A factory uses Modbus TCP between a PLC and a SCADA server. The security team has identified that the SCADA server is the only device that should be able to write to the PLC's holding registers. However, the current network allows any device on the OT network to send Modbus write requests. Which control should be implemented to enforce this policy?

   • AEnable the 'write protection' bit in the PLC's configuration to prevent all writes, including from the SCADA server.
   • BChange the PLC's IP address to a non-routable private address so that only devices on the same subnet can reach it.
   • CConfigure an industrial firewall rule that permits Modbus write function codes (e.g., 0x06, 0x10) only from the SCADA server's IP address to the PLC.
   • DInstall a Modbus TCP-to-RTU converter and rely on the serial bus's inherent security.
   Reveal Solution Discussion Select an answer first