Stealthing the IDS ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A water treatment facility wants to monitor traffic between a PLC and a remote terminal unit (RTU) over a dedicated point-to-point link. The IDS sensor must not have an IP address on the monitored link. Which deployment method is appropriate?

   • AUse the switch's port mirroring feature to send a copy of the link traffic to the sensor.
   • BPlace the sensor inline on the link and assign it an IP address from the same subnet for management.
   • CConfigure the sensor's NIC in promiscuous mode and connect it to the same hub as the PLC and RTU.
   • DUse a network TAP on the link and connect the sensor's monitoring interface to the TAP.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which method helps prevent attackers from discovering an IDS sensor by making its network identity less recognizable?

   • AEnabling SNMP on the sensor for easier management
   • BIncreasing the sensor's ARP cache timeout
   • CAssigning the sensor a static IP address
   • DUsing MAC address masking to hide the sensor's real hardware address
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security architect is evaluating IDS deployment options for a pipeline control network. The network has a mix of legacy serial-to-Ethernet devices and modern Ethernet PLCs. The architect needs to monitor traffic without introducing any possibility of a single point of failure. Which deployment strategy is most appropriate?

   • ADeploy passive IDS sensors using network TAPs on all critical Ethernet links.
   • BDeploy a hybrid of inline IPS and passive IDS, with inline on the most critical links.
   • CDeploy a single passive IDS sensor connected to a SPAN port on the core switch.
   • DDeploy inline IPS sensors with fail-open on all critical links.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An ICS security analyst is explaining to management why the IDS sensor is deployed passively with a TAP rather than inline. Which reason is most accurate?

   • APassive deployment allows the IDS to block malicious traffic without introducing latency.
   • BPassive deployment is required for all ICS/SCADA environments due to regulatory compliance.
   • CPassive deployment allows the sensor to be managed remotely without any network connection.
   • DPassive deployment makes the sensor invisible to attackers because it has no IP address on the monitored network.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is deploying a stealth IDS on a control network that has a strict change-management policy. The team cannot modify the configuration of the existing switches. The network uses a mix of copper and fiber links. The team needs to monitor a critical copper link. Which deployment approach is most appropriate?

   • AInstall a passive copper network TAP on the critical link and connect the IDS sensor to the TAP.
   • BConfigure a SPAN session on the switch, even though it violates the change-management policy.
   • CReplace the copper link with a fiber link and use a fiber TAP.
   • DUse an inline IPS with fail-open on the critical link.
   Reveal Solution Discussion Select an answer first