Securing the Protocols Unique to the ICS ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security analyst is investigating a suspected attack on a DNP3 network. The IDS logs show a series of DNP3 messages with increasing sequence numbers, but the master station reports that it did not send them. What is the most likely explanation?

   • AThe master station has a bug that causes it to send messages without logging them.
   • BAn attacker is replaying captured DNP3 messages with modified sequence numbers.
   • CThe DNP3 protocol is designed to allow any device to send messages with valid sequence numbers.
   • DThe IDS is malfunctioning and generating false positives.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A natural gas pipeline company needs to secure communications between a remote terminal unit (RTU) and the master station. The RTU is an older model that only supports Modbus RTU over serial. The master station is modern and supports multiple protocols. The company must protect the integrity of the data and prevent replay attacks. What is the best approach given the RTU's limitation?

   • ARun the Modbus RTU serial cable through a hardware encryptor that applies AES-256 encryption to the serial bitstream.
   • BUpgrade the RTU firmware to support Modbus TCP with built-in TLS encryption.
   • CPlace an industrial protocol gateway at the RTU site that converts Modbus RTU to Modbus TCP and terminates a VPN tunnel back to the master station.
   • DUse a serial-to-Ethernet converter and rely on the converter's built-in password protection to secure the link.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A manufacturing plant is deploying OPC UA across multiple production lines. Each line has its own OPC UA server and clients. The security team wants to ensure that a compromised client on one line cannot access data on another line. Which deployment configuration is most appropriate?

   • AConfigure each production line as a separate OPC UA security zone with distinct certificates and user permissions.
   • BUse a single OPC UA server for all lines and rely on user roles to restrict access.
   • CDisable OPC UA security and rely on network segmentation.
   • DPlace all OPC UA servers on the same VLAN and use a firewall to filter traffic.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A chemical plant has a mixed ICS environment with both Modbus TCP and OPC UA traffic. The security team has limited budget and can only deploy one monitoring solution. They need to detect both unauthorized writes to Modbus registers and abnormal OPC UA method calls. What is the most effective single approach?

   • ADeploy a network TAP and use Wireshark to manually analyze traffic for both protocols.
   • BDeploy an industrial IDS that supports deep packet inspection for both Modbus and OPC UA protocols.
   • CDeploy a NetFlow collector and analyze flow data for both protocols.
   • DDeploy a signature-based IPS that focuses on Modbus traffic only, since OPC UA is less commonly attacked.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An electrical utility is deploying a new DNP3 link between a substation RTU and the control center over a dedicated fiber line. The engineering team wants to ensure the link is secure against eavesdropping and message tampering. The RTU and master station both support DNP3 Secure Authentication with pre-shared keys. What is the most appropriate configuration for this new deployment?

   • AConfigure DNP3 to use TLS by setting the 'transport security' flag in the DNP3 configuration file.
   • BRely on the physical security of the dedicated fiber line and leave DNP3 authentication disabled to avoid adding latency.
   • CEnable DNP3 Secure Authentication with pre-shared keys and configure the master station to require authentication for all unsolicited responses and control commands.
   • DImplement a VPN tunnel over the fiber link and disable DNP3 Secure Authentication to reduce configuration complexity.
   Reveal Solution Discussion Select an answer first