Securing the Protocols Unique to the ICS ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a well-known vulnerability inherent to the Modbus protocol that allows an attacker to intercept and modify communications?

   • AInability to operate over serial lines
   • BRequires a dedicated physical link for each master-slave pair
   • CUse of TCP port 502, which is often blocked by firewalls
   • DLack of built-in encryption and authentication
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A manufacturing company is deploying a new OPC UA server to replace a legacy OPC DA server. The new server will be accessed by multiple clients from different vendors. The security team wants to ensure that only authorized clients can read and write data, and that all communications are encrypted. However, some legacy clients do not support OPC UA security policies. What is the best approach?

   • AConfigure the OPC UA server to use SecurityPolicy 'None' to ensure all clients can connect, and rely on network segmentation for security.
   • BDeploy the OPC UA server with a security policy that requires encryption and authentication, and use an OPC UA gateway to translate for legacy clients that cannot support the security policy.
   • CUpgrade all legacy clients to support OPC UA security policies before deploying the new server.
   • DRun both OPC DA and OPC UA servers in parallel and have clients connect to the appropriate server.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security analyst is tuning an IDS for a mixed ICS environment that uses Modbus TCP, DNP3, and OPC UA. The analyst wants to reduce false positives while still detecting protocol-specific attacks. Which approach is most effective?

   • ACreate separate IDS rules for each protocol that model the expected state transitions and allowed function codes.
   • BDisable all IDS rules and rely on manual log review.
   • CUse a signature-based IDS with generic ICS signatures from the vendor.
   • DUse a single generic rule that flags any traffic on ports 502, 20000, and 4840.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst is monitoring a DNP3 network that uses Secure Authentication. The analyst notices that the master station is sending a large number of authentication challenge requests to an RTU, but the RTU is not responding. The master station then sends a control command without waiting for the authentication response. What is the most likely issue?

   • AThe RTU's authentication key is misconfigured, causing it to reject the challenges, and the master station is configured to fail-open and send the command anyway.
   • BThe RTU has been compromised and is intentionally ignoring the challenges, and the master station is correctly sending the command to maintain operations.
   • CThe master station is using the correct authentication procedure, and the RTU is simply slow to respond due to network latency.
   • DThe RTU is under a denial-of-service attack and cannot process the challenges, but the master station is correctly sending the command as a fallback.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A water treatment facility uses Modbus TCP between a PLC and an HMI. A security assessment reveals that an attacker with network access could send a write command to a coil that controls a chlorine dosing valve. The facility cannot replace the PLCs or HMI this year. Which immediate mitigation should the team implement to reduce this risk?

   • AEnable the built-in password protection feature available in the Modbus TCP protocol specification.
   • BSwitch the HMI and PLC to use DNP3 over TCP instead of Modbus TCP.
   • CPlace the HMI and PLC on the same VLAN and remove all routing between the control network and the corporate network.
   • DDeploy an industrial firewall that inspects Modbus function codes and restricts writes to only the HMI's IP address.
   Reveal Solution Discussion Select an answer first