Selecting and Applying Controls to Mitigate Risk ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A natural gas pipeline company has implemented a defense-in-depth strategy with firewalls, IDS, and access controls. However, a recent penetration test revealed that an attacker could bypass the IDS by using encrypted traffic. Which additional control would best address this gap?

   • AIncrease the sensitivity of the IDS to detect more anomalies.
   • BDeploy a TLS/SSL inspection proxy on the OT network to decrypt and inspect encrypted traffic.
   • CBlock all encrypted traffic on the OT network.
   • DAdd more firewall rules to restrict encrypted traffic to specific hosts.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In a defense-in-depth approach for an ICS, which combination of controls represents a layered strategy?

   • AA strong password policy applied to all users
   • BA single antivirus solution installed on all workstations
   • CPhysical locks on all server racks only
   • DFirewall at the perimeter, network segmentation, and host-based intrusion detection on critical servers
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A hospital's building management system (BMS) controls HVAC and access doors. The BMS is managed by an external vendor who requires remote access for maintenance. The hospital's security policy requires least privilege and accountability, but the vendor insists on using a shared account for simplicity. What is the best way to satisfy both the vendor and the security policy?

   • AAllow the vendor to use the shared account but monitor all sessions with screen recording.
   • BCreate a unique account for the vendor with permissions limited to the BMS, and require the vendor to use a VPN with multi-factor authentication.
   • CGive the vendor a domain admin account to simplify access to all systems.
   • DDisable remote access and require the vendor to be on-site for all maintenance.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a common implementation of network zoning in an ICS?

   • AUsing a single VLAN for all ICS devices regardless of function
   • BPlacing all devices, including corporate and control systems, on a single flat network
   • CConnecting all ICS devices directly to the internet for remote access
   • DSeparating the corporate network from the control network with a firewall and a DMZ
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A wastewater treatment plant has deployed a network intrusion detection system (NIDS) on the control network. The security analyst notices that the NIDS generates many false positives due to legitimate broadcast traffic from the PLCs. The analyst wants to reduce the noise while still detecting real threats. What should the analyst do?

   • ADisable the NIDS during peak production hours to avoid false positives.
   • BIncrease the sensitivity of the NIDS to catch more threats.
   • CTune the NIDS rules to whitelist known PLC broadcast traffic and adjust thresholds for other traffic.
   • DMove the NIDS to the IT network where there is less broadcast traffic.
   Reveal Solution Discussion Select an answer first