Stealthing the IDS ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary function of a network TAP in a stealth IDS deployment?

   • ATo combine multiple network segments into a single monitoring point
   • BTo filter out malicious traffic before it reaches the IDS
   • CTo provide a passive, out-of-band copy of network traffic for the IDS to analyze
   • DTo encrypt traffic so that attackers cannot read it
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key difference between inline and passive IDS deployment modes?

   • APassive IDS can be deployed without any network changes, while inline IDS requires no changes either
   • BInline IDS is always more stealthy than passive IDS
   • CInline IDS uses a network TAP, while passive IDS uses port mirroring
   • DInline IDS can block traffic, while passive IDS only monitors and alerts
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A critical infrastructure operator is deploying an IDS sensor to monitor a serial-to-Ethernet gateway. The sensor must not introduce any latency or become a point of failure. The switch does not support port mirroring. Which deployment method should be used?

   • APlace the sensor inline between the gateway and the switch, configuring it to operate in fail-open mode.
   • BUse the switch's SPAN port to send a copy of traffic to the sensor, even though the switch does not support it.
   • CInstall the sensor on the same VLAN as the gateway and enable promiscuous mode on its NIC.
   • DConnect the sensor to a network TAP installed between the gateway and the switch.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which configuration best practice reduces the network footprint of an IDS sensor to help maintain stealth?

   • AUsing the default vendor configuration for all settings
   • BDisabling unnecessary services and protocols on the sensor
   • CPlacing the sensor on the same network segment as the internet-facing firewall
   • DEnabling all available services to ensure full functionality
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is configuring a stealth IDS sensor on an ICS network. The analyst wants to prevent an attacker who has gained access to the control network from easily identifying the sensor by its network behavior. Which configuration is most effective for this purpose?

   • AConfigure the sensor's management interface with a non-standard IP address that is not in any DNS records.
   • BEnable the sensor to respond to ICMP echo requests on its management interface.
   • CPlace the sensor's management interface on the same VLAN as the engineering workstations to simplify monitoring.
   • DUse a passive TAP and configure the sensor's management interface to use a MAC address that is not the burned-in address.
   Reveal Solution Discussion Select an answer first