Securing the Protocols Unique to the ICS ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A water treatment plant uses Modbus TCP between a PLC and an HMI. The security team discovers that an attacker can send a specially crafted Modbus packet that causes the PLC to enter an error state. This is an example of which vulnerability?

   • AA buffer overflow in the HMI software that allows remote code execution.
   • BA misconfigured firewall that allows traffic from the IT network.
   • CWeak encryption in Modbus TCP that allows an attacker to decrypt the traffic.
   • DLack of authentication and authorization in Modbus TCP, allowing any host to send malformed requests.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A utility is upgrading a legacy DNP3 serial link to DNP3 over TCP/IP. The link carries control commands and must meet a new regulatory requirement for message integrity. The engineering team wants to minimize latency and avoid changing the master station software. Which approach best satisfies the requirement?

   • AUse Modbus TCP with TLS wrapping because it has lower latency than DNP3 SAv5.
   • BImplement a custom application-layer checksum in the master station software.
   • CUse a VPN tunnel with encryption but do not enable SAv5.
   • DEnable DNP3 Secure Authentication (SAv5) with aggressive timeouts and pre-shared keys on both ends.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A pharmaceutical company uses OPC UA between a batch control system and a supervisory server. The security team must ensure that only authorized applications can read and write data, and that the data is not exposed to eavesdroppers on the network. Which OPC UA configuration should be used?

   • AUse OPC UA with the None security policy and anonymous user access.
   • BEnable only the Sign security mode with anonymous access.
   • CUse OPC UA with Basic128Rsa15 and SignAndEncrypt but disable user authentication.
   • DConfigure OPC UA with Basic256Sha256 security policy, SignAndEncrypt security mode, and user authentication via certificates.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A utility is deploying a new DNP3 network with multiple masters and outstations. The security team wants to ensure that only authorized masters can control specific outstations. Which deployment configuration is most appropriate?

   • AUse Modbus TCP with IP-based access control lists.
   • BConfigure DNP3 Secure Authentication with unique pre-shared keys for each master-outstation pair.
   • CUse the same pre-shared key for all masters and outstations to simplify key management.
   • DDisable DNP3 Secure Authentication and rely on the network firewall.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A manufacturing plant uses OPC UA for communication between a historian and several PLCs. The security team wants to detect an attacker who has gained access to the plant network and is attempting to enumerate or manipulate OPC UA server data. Which monitoring approach would be most effective for this specific protocol?

   • ADeploy an OPC UA-aware intrusion detection system that inspects application-layer payloads for unauthorized read/write operations and abnormal method calls.
   • BUse a standard signature-based IPS with generic Modbus signatures to protect the OPC UA traffic.
   • CMonitor network traffic for any TCP connections to port 4840 and alert on any new connection to the historian.
   • DEnable NetFlow on the plant switches and analyze flow records for unusual traffic volumes to the historian.
   Reveal Solution Discussion Select an answer first