Stealthing the IDS ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is deploying an IDS sensor in a manufacturing facility. The sensor must be stealthy and have minimal impact on the network. Which set of best practices should be applied?

   • AUse a network TAP for monitoring, disable unnecessary services, and place the management interface on a separate VLAN.
   • BUse a hub to connect the sensor to the network and enable promiscuous mode on its NIC.
   • CConnect the sensor to a SPAN port and assign it a public IP address for remote management.
   • DPlace the sensor inline with a fail-open bypass and enable SNMP for easy monitoring.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A water utility has a legacy control network with a switch that does not support port mirroring. The security team wants to deploy a passive IDS to monitor a critical link. The link is a full-duplex fiber connection. The team has a budget for one new device. Which device should they purchase to achieve passive monitoring with minimal disruption?

   • AAn inline network probe that can be configured to forward traffic.
   • BA managed switch with SPAN capability to replace the existing switch.
   • CA media converter with a monitoring port.
   • DA fiber network TAP that splits the optical signal to provide a copy to the IDS.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which technique can be used to obfuscate the presence of an IDS sensor on an ICS network?

   • ADisabling all logging on the sensor
   • BPlacing the sensor on the same subnet as the HMI without any firewall rules
   • CUsing a hub instead of a switch to connect the sensor
   • DConfiguring the sensor to use a non-standard management port
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An ICS security engineer is deploying a stealth IDS sensor on a network segment that also carries routine IT traffic. The engineer wants to minimize the chance that an attacker who is scanning the segment will identify the sensor as a security device. Which technique is most effective?

   • ADisable all network interfaces on the sensor except the monitoring interface.
   • BConfigure the sensor to respond to ARP requests with a spoofed IP address that is not in use on the network.
   • CUse a static IP address that is outside the DHCP range and document it in the asset inventory.
   • DAssign the sensor a MAC address that matches the vendor OUI of a common PLC on the segment.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An attacker has gained access to a workstation on the same Ethernet segment as a stealth IDS sensor. The attacker is using ARP scanning to map the segment. The IDS sensor's monitoring interface is connected to a passive TAP and has no IP address. The management interface is on a separate VLAN. Which additional measure would best prevent the attacker from discovering the sensor's management interface?

   • AConfigure the management interface to not respond to ARP requests from any device other than the management station.
   • BEnable the management interface to respond to ARP requests with a spoofed IP address.
   • CPlace the management interface on the same VLAN as the monitoring interface.
   • DAssign the management interface a MAC address that matches the attacker's workstation.
   Reveal Solution Discussion Select an answer first