Types of IDS (Network, Host, Network Node) ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A manufacturing plant has a mix of modern Windows-based HMIs and legacy embedded controllers that cannot run any security software. The security team wants to detect both (a) an attacker using stolen credentials to run unauthorized commands on an HMI and (b) a rogue device on the plant floor sending malformed Modbus/TCP packets to a PLC. Which combination of IDS types would cover both scenarios?

   • ADeploy a HIDS on the HMI and a NIDS on the plant-floor network segment.
   • BDeploy a single NIDS at the plant's internet edge to cover both the HMI and the PLC.
   • CDeploy an NNIDS on the HMI and a NIDS on the corporate gateway.
   • DDeploy a NIDS on the HMI's network interface and a HIDS on the PLC.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A pipeline company has a long-haul SCADA network with multiple compressor stations connected over a WAN. Each station has a local Ethernet LAN with several RTUs. The security team wants to detect an attacker who has gained access to one station's LAN and is scanning for other RTUs on the same segment. Which sensor placement would give the earliest warning of this lateral scanning?

   • AA NIDS connected to a SPAN port on the station's core switch, monitoring all intra-LAN traffic.
   • BA HIDS agent on each RTU to detect the scan by monitoring local network connections.
   • CAn NNIDS installed on the central SCADA master to monitor all station traffic.
   • DA NIDS placed only at the WAN router's uplink to the central SCADA master.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A manufacturing plant has multiple isolated production cells, each with its own switch. The security team wants to detect lateral movement between cells. They have a limited number of monitoring appliances. Which deployment is most effective?

   • ADeploy a network node IDS (NNIDS) on one device in each cell.
   • BInstall a host-based IDS (HIDS) on every workstation in each cell.
   • CUse a passive tap on each cell's uplink to the core switch.
   • DPlace a network-based IDS (NIDS) at the core switch that interconnects the production cells.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which statement best describes how a Network-based IDS (NIDS) monitors activity in an ICS network?

   • AIt checks the configuration of network switches and routers for compliance
   • BIt examines system logs and file integrity on each PLC to detect tampering
   • CIt analyzes network packets captured from a network segment to detect malicious patterns or anomalies
   • DIt monitors the CPU and memory usage of each server to detect resource exhaustion attacks
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In an ICS environment, a Network Node IDS (NNIDS) is deployed on a critical HMIserver. What does the NNIDS monitor?

   • AThe physical access logs of the server room
   • BAll network traffic to and from that specific HMI server
   • CAll network traffic across the entire plant floor segment
   • DThe file integrity and system logs of the HMI server
   Reveal Solution Discussion Select an answer first