Securing the Protocols Unique to the ICS ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A water utility is deploying a new Modbus TCP network between a control center and several remote pumping stations. The network will be isolated from the corporate IT network. The security team wants to prevent unauthorized devices from joining the Modbus network. Which deployment control is most appropriate?

   • AUse a hub instead of a switch to simplify monitoring of all traffic.
   • BConfigure the managed switches to enable port security and MAC address allow-listing for all connected devices.
   • CAssign static IP addresses to all devices and rely on IP address filtering.
   • DEnable Modbus TCP's built-in authentication feature.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A water utility has a mix of Modbus TCP and DNP3 devices. The security team is implementing a new security policy that requires all control commands to be authenticated. The Modbus devices do not support any authentication, and the DNP3 devices support Secure Authentication. The team has a limited budget and cannot replace the Modbus devices. What is the most effective way to meet the policy for the Modbus devices?

   • ADeploy an industrial firewall that only allows Modbus write commands from the SCADA server's IP address and blocks all other write attempts.
   • BUse a Modbus-to-DNP3 gateway and enable DNP3 Secure Authentication on the gateway to authenticate the SCADA server.
   • CReplace the Modbus devices with DNP3 devices that support Secure Authentication.
   • DImplement a VPN between the SCADA server and the Modbus devices to provide authentication.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security engineer is reviewing the configuration of a Modbus TCP network and notices that the PLCs are accepting connections from any source IP. The engineer also notices that the SCADA server uses a fixed function code to read data. What is the most significant vulnerability in this configuration?

   • AThe SCADA server should use a different protocol, such as DNP3, to improve security.
   • BThe PLCs should be configured to use a different port number to avoid detection by attackers.
   • CThe use of a fixed function code for reading data makes the traffic predictable and easier to replay.
   • DThe lack of source IP filtering allows any device on the network to send Modbus commands, including writes, to the PLCs.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A manufacturing plant uses OPC UA for data exchange between a historian and multiple PLCs. The security team wants to detect an attacker who is replaying captured OPC UA messages to alter setpoints. Which monitoring approach is most effective?

   • ADisable OPC UA security policies so the IDS can read the plaintext messages.
   • BDeploy an IDS that inspects OPC UA application-layer payloads and correlates sequence numbers and timestamps.
   • CMonitor only the TCP port 4840 for any connection attempts from unknown IP addresses.
   • DEnable OPC UA anonymous access to simplify traffic analysis.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security analyst is investigating a suspected attack on a Modbus TCP network. The analyst sees a series of Modbus read requests from a single source IP to multiple PLCs, each request reading a different register range. The requests are occurring at a rate much higher than normal. What is the most likely explanation?

   • AAn attacker is performing reconnaissance to map the register layout of the PLCs to identify critical data or control points.
   • BThe PLCs are experiencing a firmware update that causes them to send read requests to each other.
   • CA legitimate SCADA server is performing a routine data collection sweep that was recently added to the system.
   • DAn attacker is attempting a denial-of-service attack by flooding the PLCs with read requests to exhaust their CPU.
   Reveal Solution Discussion Select an answer first