Stealthing the IDS ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A stealth IDS sensor is being deployed on a serial-to-Ethernet gateway segment in a power utility. The sensor must not be discoverable by an attacker who has already compromised a workstation on the same Ethernet segment. Which set of configuration practices best achieves this?

   • AConnect the sensor to a SPAN port and enable LLDP to advertise its presence for easier troubleshooting.
   • BUse an inline IPS with fail-open and enable SNMP on the management interface for monitoring.
   • CUse a passive TAP, disable all management services on the monitoring interface, and place the management interface on a separate VLAN with strict firewall rules.
   • DGive the sensor a hostname that resembles a PLC and enable SSH on the monitoring interface.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security architect is planning a stealth IDS deployment for a large industrial campus. The campus has multiple switches that support port mirroring, but the security team is concerned about the performance impact of mirroring on the switches. The architect wants to minimize the chance of an attacker discovering the IDS sensors. Which approach is most appropriate?

   • AUse port mirroring only on the core switch and place the sensors inline with a fail-open bypass.
   • BUse port mirroring on all switches and place the sensors on a dedicated monitoring VLAN.
   • CUse a combination of port mirroring and TAPs, but disable the management interfaces on all sensors to ensure stealth.
   • DUse network TAPs at critical aggregation points and connect the sensors to the TAPs, with management interfaces on a separate network.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is deploying an IDS in a wastewater treatment plant. The plant has a mix of legacy serial devices and modern Ethernet devices. The team wants to monitor both types of traffic. The IDS sensor has limited processing power. The team must decide between passive and inline deployment. Which consideration is most important?

   • AInline deployment is preferred because it can block malicious traffic and is easier to manage remotely.
   • BPassive deployment is always preferred in OT environments because it avoids any risk of disrupting operations.
   • CInline deployment is required to monitor serial traffic because TAPs do not support serial interfaces.
   • DPassive deployment is preferred because it does not introduce latency or become a single point of failure, but it cannot block traffic.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How can IP spoofing be used to protect an IDS sensor from being discovered?

   • ABy changing the sensor's IP address every second to avoid detection
   • BBy using IP spoofing to bypass the firewall
   • CBy allowing the sensor to send packets with fake source addresses to attackers
   • DBy making the sensor appear to have a different IP address than it actually uses for management
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A water utility has a legacy serial-to-Ethernet gateway on a flat OT network. The security team wants to deploy an IDS sensor to monitor traffic between the gateway and the SCADA servers without introducing any new IP address that an attacker could probe. The switch does not support port mirroring. Which approach best meets the requirement?

   • AUse the switch's SPAN port to send a copy of traffic to the IDS sensor, even though the switch does not officially support port mirroring.
   • BConfigure the IDS sensor with a secondary interface connected to a network TAP placed inline between the gateway and the switch.
   • CConnect the IDS sensor directly to the same switch port as the gateway using a hub and assign the sensor an IP address in the management VLAN.
   • DPlace the IDS sensor inline between the gateway and the switch, configuring it with a static IP address to allow remote management.
   Reveal Solution Discussion Select an answer first