Stealthing the IDS ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is deploying an IDS sensor on a network segment with a potential adversary. The analyst wants to prevent the attacker from discovering the sensor by its MAC address. Which technique is most appropriate?

   • AConfigure the sensor's NIC to use a MAC address that is not associated with the sensor's vendor.
   • BDisable the NIC's MAC address learning and use a static ARP entry.
   • CAssign the sensor a MAC address that is the same as the default gateway's MAC address.
   • DUse a network TAP for the monitoring interface so that the sensor's MAC address never appears on the wire.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security engineer is configuring an IDS sensor that must communicate with a central management server. The engineer wants to hide the sensor's management traffic from network sniffers. Which technique is most effective?

   • AEncrypt the management traffic using TLS or IPsec.
   • BSpoof the source IP address of the management traffic.
   • CSend management traffic only during off-peak hours.
   • DUse a non-standard port for the management protocol.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An ICS security analyst is configuring a stealth IDS sensor that will monitor traffic on a network segment where attackers are known to perform active reconnaissance. The analyst wants to ensure that the sensor does not respond to any unsolicited network probes. Which configuration is most effective?

   • AEnable promiscuous mode on the monitoring interface and set the MAC address to all zeros.
   • BConfigure the sensor's monitoring interface to have no IP address and use a passive TAP.
   • CUse an inline IPS with the sensor's management interface on the same subnet as the monitored devices.
   • DAssign an IP address to the monitoring interface and configure a host-based firewall to block all incoming traffic.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team is deciding between an inline IPS and a passive IDS for a chemical plant's control network. The plant's safety system requires that no single device failure can interrupt the control traffic. Which deployment mode should be chosen and why?

   • APassive IDS with an inline bypass switch, because it provides both monitoring and failover.
   • BPassive IDS, because it does not sit in the data path and therefore cannot interrupt control traffic if it fails.
   • CInline IPS with fail-closed mode, because it ensures that if the device fails, traffic is blocked, which is safer.
   • DInline IPS with fail-open mode, because it can still block attacks while ensuring traffic flows if the device fails.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In an ICS/SCADA environment, what is the primary purpose of deploying an IDS in stealth mode?

   • ATo allow the IDS to block malicious traffic in real time
   • BTo reduce the number of false positives generated by the IDS
   • CTo hide the IDS sensor from attackers and prevent them from evading or targeting it
   • DTo increase the processing speed of the IDS analysis engine
   Reveal Solution Discussion Select an answer first