Stealthing the IDS ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An ICS security team is deploying a stealth IDS on a network segment that is monitored by a third-party MSSP. The MSSP requires a management connection to the sensor for log retrieval. The team is concerned that an attacker who has compromised a workstation on the same segment could use the MSSP connection to discover the sensor. Which approach best balances the MSSP requirement with stealth?

   • AEstablish a dedicated out-of-band VPN from the MSSP to the sensor's management interface, and restrict the sensor to only respond to the MSSP's IP address.
   • BPlace the sensor's management interface on the same VLAN as the MSSP's collector and use a shared password.
   • CHave the sensor initiate outbound connections to the MSSP over the control network using SSH.
   • DAllow the MSSP to connect to the sensor's management interface over the control network using a non-standard port.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   How does port mirroring (SPAN) on a switch support a stealth IDS deployment?

   • AIt assigns a separate IP address to the IDS to hide its identity
   • BIt forwards a copy of traffic from selected ports to a monitoring port where the IDS is connected
   • CIt creates a virtual private network for the IDS to communicate securely
   • DIt blocks traffic from reaching the IDS to prevent detection
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security engineer is deploying an IDS sensor in a high-security OT environment. The sensor's monitoring interface is connected to a network TAP. The engineer wants to prevent an attacker from identifying the sensor by its management traffic. The management network is shared with other IT devices. Which technique is most effective?

   • AEncrypt all management traffic using IPsec and use a non-standard port for the management protocol.
   • BUse a separate physical management network that is not connected to the IT network.
   • CSpoof the source IP address of the management traffic to match a legitimate IT server.
   • DDisable the management interface and rely on the sensor's local console for all configuration and alert retrieval.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An ICS security analyst is configuring a stealth IDS sensor that will be placed on a network segment where an attacker is known to use port scanning to identify devices. The analyst wants to make the sensor appear as a non-security device. Which configuration is most effective?

   • AAssign the sensor a hostname that includes 'ids' to confuse attackers.
   • BClose all ports on the sensor's management interface and use a MAC address that matches a common PLC vendor.
   • COpen a few common ports such as 80 and 443 on the sensor's management interface.
   • DUse a non-standard IP address in the 169.254.0.0/16 range.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SCADA network uses a full-duplex link between a primary and backup controller. The security team wants to deploy a passive IDS to monitor both directions of traffic. The switch does not support port mirroring. Which device should be used to capture the traffic?

   • AA hub connected to the link between the two controllers.
   • BA firewall with a monitoring port that mirrors traffic.
   • CA router configured to route a copy of the traffic to the IDS.
   • DA network TAP that aggregates both directions of the full-duplex link.
   Reveal Solution Discussion Select an answer first