TCP/IP Protocol Architecture ICSSCADA Practice Questions (Page 8)

Questions 36–39

1. 36expert · medium

   A security analyst is examining a packet capture from an ICS network. The capture shows a TCP SYN packet from an internal engineering workstation to an external IP address on port 21. The analyst also sees a corresponding SYN-ACK response. What does this exchange indicate?

   • AThe workstation is sending an FTP data transfer on port 20.
   • BThe workstation is establishing an outbound FTP control connection to an external server.
   • CThe workstation is performing a DNS query over TCP.
   • DThe workstation is using UDP to transfer files.
   Reveal Solution Discussion Select an answer first
2. 37expert · medium

   A network engineer is explaining to a new technician how a packet from an HMI application is sent to a PLC on another subnet. The engineer describes the encapsulation process. Which sequence correctly describes the encapsulation from the application layer down to the network interface?

   • AApplication data → Ethernet header → IP header → TCP header
   • BApplication data → TCP header → IP header → Ethernet header
   • CEthernet header → IP header → TCP header → Application data
   • DApplication data → IP header → TCP header → Ethernet header
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In a typical ICS/SCADA network, what is the primary purpose of using TCP/IP in the upper layers of the architecture?

   • ATo enable communication between the SCADA host and field devices using industrial protocols over standard networks
   • BTo encrypt all data transmitted between field devices and the control center
   • CTo provide real-time deterministic control of physical processes
   • DTo replace the need for fieldbus protocols like Modbus or Profibus
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A water treatment plant has a control network with PLCs on 192.168.10.0/24 and HMI workstations on 192.168.20.0/24. A new requirement mandates that all inter-subnet traffic be inspected by an IDS. The plant also needs to maintain low latency for time-critical control messages. The engineer proposes placing an IDS inline between the two subnets. What is the primary trade-off the engineer must consider?

   • AInline IDS will encrypt the traffic, making it unreadable to the HMI.
   • BInline IDS will block all UDP traffic, preventing time-critical messages.
   • CInline IDS requires a separate subnet for each PLC, which is not feasible.
   • DInline IDS adds latency and becomes a single point of failure for control traffic.
   Reveal Solution Discussion Select an answer first