Types of IDS (Network, Host, Network Node) ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A food processing plant has a single critical packaging machine that communicates with a PLC over a dedicated point-to-point Ethernet link. The machine's vendor refuses to allow any inline security device that could introduce latency. The security team wants to detect an attacker sending unauthorized setpoints to the PLC over this link. Which deployment satisfies the vendor's constraint?

   • ADeploy an NNIDS using a passive optical TAP on the dedicated link between the machine and the PLC.
   • BPlace an inline IPS between the machine and the PLC to block unauthorized setpoints.
   • CInstall a HIDS on the PLC to monitor its network connections.
   • DDeploy a NIDS at the plant's core switch to see the dedicated link's traffic.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A host-based IDS (HIDS) is installed on an engineering workstation in an ICS environment. Which activity is the HIDS most likely to monitor?

   • AThe physical security of the server room where the workstation is located
   • BTraffic flowing between the workstation and the PLC network segment
   • CChanges to critical system files and configuration files
   • DThe overall bandwidth utilization of the corporate network link
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A security analyst is planning to deploy a Network-based IDS (NIDS) in an ICS environment. Which deployment location is most typical for a NIDS sensor?

   • AOn the historian server to verify database integrity and log entries
   • BOn a strategic network segment, such as at the boundary between the corporate network and the control network
   • COn each individual workstation to monitor local file access and process activity
   • DOn the engineering workstation to monitor USB device insertion and registry changes
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does a Network Node IDS (NNIDS) differ from a traditional Network-based IDS (NIDS)?

   • ANNIDS monitors traffic on a specific network node, while NIDS monitors traffic on an entire network segment
   • BNNIDS uses signature-based detection only, while NIDS uses anomaly-based detection only
   • CNNIDS is placed at the network perimeter, while NIDS is placed on individual servers
   • DNNIDS is installed on the host and monitors system logs, while NIDS monitors network packets
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An engineer wants to monitor all traffic to and from a specific RTU that uses a proprietary protocol. The RTU is on a segment with many other devices, and the engineer only cares about this one node. Which IDS type is most appropriate?

   • AA network tap on the backbone link to capture all inter-subnet traffic.
   • BNetwork node IDS (NNIDS) placed on the RTU's network segment to monitor only that node's traffic.
   • CHost-based IDS (HIDS) installed on the RTU to monitor its local logs.
   • DNetwork-based IDS (NIDS) placed at the segment's gateway to monitor all traffic.
   Reveal Solution Discussion Select an answer first