Types of IDS (Network, Host, Network Node) ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A regional power utility has a substation with a single critical protection relay that communicates with a central SCADA master over a dedicated serial link. The relay has no logging capability and cannot run any third-party software. The security team needs to detect malicious commands sent to this relay without affecting the serial communication. Which approach best fits the constraint?

   • ADeploy an NNIDS inline on the serial link using a passive tap that inspects only the relay's traffic.
   • BUse a network TAP on the substation's WAN router to monitor all traffic to the SCADA master.
   • CInstall a HIDS agent on the relay to monitor its serial port activity.
   • DPlace a NIDS at the substation's Ethernet switch to see the serial traffic encapsulated in TCP/IP.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A water utility has a flat Layer 2 network with a single core switch connecting all OT devices, a historian, and the engineering workstations. The security team wants to detect malware beaconing outbound to the internet and lateral movement between OT zones, but they cannot install agents on the legacy PLCs and RTUs. Which deployment provides the broadest visibility with the least operational impact?

   • AInstall a network TAP on the core switch uplink and deploy a NIDS that analyzes all traffic crossing the backbone.
   • BInstall a HIDS agent on each PLC and RTU to monitor local process memory and network connections.
   • CDeploy an NNIDS on the historian only, since it is the most critical server and sees all OT traffic.
   • DConfigure SPAN on the core switch to send only broadcast traffic to the NIDS to reduce load.
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   A pipeline company has a control network with multiple segments. They have a NIDS on the main backbone, but they suspect a specific pump station is being targeted. They want to increase visibility into that station's traffic without affecting the rest of the network. Which action is most effective?

   • AInstall a host-based IDS (HIDS) on every device at the pump station.
   • BDeploy a network node IDS (NNIDS) at the pump station's network segment to monitor traffic to and from the station's devices.
   • CAdd a second NIDS on the pump station's segment.
   • DMove the existing NIDS to the pump station's segment.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which monitoring source is a host-based IDS (HIDS) designed to analyze?

   • ASystem logs and file integrity data on the host where it is installed
   • BModbus/TCP traffic between a master and a remote terminal unit
   • CNetwork packets captured from a switch SPAN port
   • DDNS queries sent from the host to external servers
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A pharmaceutical company has a historian server that stores batch records. Compliance requires detecting any unauthorized change to the server's configuration files or system logs. The server is in a secured VLAN with limited network monitoring. Which IDS type is most appropriate?

   • AA firewall with logging enabled to record all inbound connections to the server.
   • BHost-based IDS (HIDS) that monitors file integrity and system logs on the historian server.
   • CNetwork-based IDS (NIDS) placed at the VLAN gateway to inspect all traffic to the server.
   • DNetwork node IDS (NNIDS) installed on the switch port connected to the server.
   Reveal Solution Discussion Select an answer first