Securing the Protocols Unique to the ICS ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A utility company has a DNP3 network between a master station and multiple RTUs. The company wants to ensure that only the master station can send control commands to the RTUs. The RTUs support DNP3 Secure Authentication. What is the most effective way to enforce this policy?

   • AUse a firewall to block all DNP3 traffic except from the master station's IP address.
   • BImplement a VPN between the master station and each RTU to encrypt the traffic.
   • CSet the RTUs to only accept DNP3 messages with a specific source address in the DNP3 header.
   • DConfigure DNP3 Secure Authentication on the RTUs to require a valid challenge-response from the master station for all control commands.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A manufacturing facility uses DNP3 over TCP/IP between a control center and field devices. The security team wants to mitigate the risk of an attacker sending unauthorized control commands. Which control is most effective?

   • ADisable DNP3 Secure Authentication to reduce latency.
   • BFilter DNP3 traffic based on the source IP address at the firewall.
   • CEnable DNP3 Secure Authentication (SAv5) with a pre-shared key for all master-outstation pairs.
   • DUse Modbus TCP instead of DNP3 because it has built-in authentication.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which security control is most effective in mitigating the lack of authentication in Modbus TCP communications?

   • ASetting the Modbus slave addresses to a random value
   • BEnabling the built-in encryption feature of Modbus TCP
   • CUsing a serial-to-Ethernet converter to change the protocol to DNP3
   • DImplementing network-level access control lists (ACLs) to restrict which IP addresses can reach the Modbus TCP port
   Reveal Solution Discussion Select an answer first
5. 39expert · hard · select all that apply

   A security engineer is designing a secure DNP3 deployment for a new substation. The engineer must ensure that the DNP3 traffic is protected against eavesdropping, tampering, and replay attacks. The RTU and master station both support DNP3 Secure Authentication. Which of the following controls should be implemented? (Select all that apply.)

   • AEnable DNP3 Secure Authentication with pre-shared keys on both the master station and the RTU.
   • BUse a VPN tunnel between the master station and the RTU to encrypt the DNP3 traffic.
   • CConfigure the DNP3 master station to use a fixed source address for all messages.
   • DImplement a firewall rule that only allows DNP3 traffic from the master station's IP address to the RTU.
   Check answers Discussion Select an answer first
6. 40expert · hard

   A security engineer is configuring OPC UA security for a new deployment. The engineer wants to ensure that data is encrypted and that clients are authenticated, but also wants to minimize the performance impact on the control system. The engineer is considering using SecurityPolicy 'Basic128Rsa15' instead of 'Basic256Sha256'. What is the most important trade-off to consider?

   • ABasic128Rsa15 is not supported by most OPC UA clients, while Basic256Sha256 is universally supported.
   • BBasic128Rsa15 does not provide data integrity, only encryption, while Basic256Sha256 provides both.
   • CBasic128Rsa15 is less secure than Basic256Sha256 because it uses a weaker encryption algorithm and shorter key length, making it more susceptible to cryptographic attacks.
   • DBasic128Rsa15 is more secure than Basic256Sha256 because it uses a newer encryption algorithm.
   Reveal Solution Discussion Select an answer first