Types of IDS (Network, Host, Network Node) ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A manufacturing company has a segmented OT network with a DMZ between IT and OT. The security team wants to detect an attacker who has already compromised a workstation in the OT zone and is using it to pivot to other OT devices. The team can deploy only one IDS sensor. Which placement gives the best chance of detecting the pivot?

   • AA NIDS in the DMZ, monitoring traffic between IT and OT.
   • BA NIDS on the OT core switch, monitoring all intra-OT traffic.
   • CAn NNIDS on the OT firewall's internal interface.
   • DA HIDS on the compromised workstation.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A pharmaceutical company's OT network is air-gapped from the corporate IT network. The security team is concerned about a rogue engineer using a USB drive to load unauthorized firmware onto a specific batch controller. The controller does not support any monitoring agent, but the Windows-based engineering workstation used to program it does. Which control would directly detect the unauthorized firmware change?

   • AInstall an NNIDS on the batch controller's network interface to monitor its inbound programming commands.
   • BUse a network TAP to capture all traffic between the workstation and the controller and compare it to a baseline.
   • CPlace a NIDS on the air-gapped network's core switch to watch for USB-related traffic.
   • DDeploy a HIDS on the engineering workstation with file integrity monitoring for the firmware files and a log collector for the programming application.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A water utility has a critical server that runs a proprietary SCADA application. The server is in a secured VLAN with a NIDS monitoring the VLAN. The security team is concerned about an insider with local access to the server. They want to detect any modification to the application binaries or configuration files. Which approach is best?

   • ARely on the existing NIDS to detect the modification through network traffic.
   • BDeploy a host-based IDS (HIDS) on the server to monitor file integrity and system logs.
   • CAdd a network node IDS (NNIDS) on the server's VLAN to monitor traffic to the server.
   • DUse a firewall with application whitelisting to block unauthorized changes.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A hospital's building automation system (BAS) uses a Windows server to manage HVAC controllers. The security team suspects that an attacker has been tampering with the server's configuration files and scheduled tasks over the past month. The server is not generating any network traffic that would indicate a remote attack. Which IDS capability would provide the most direct evidence of this local tampering?

   • AAn NNIDS on the BAS server's network interface to monitor its inbound management traffic.
   • BA HIDS with file integrity monitoring and Windows event log collection on the BAS server.
   • CA network TAP on the BAS server's switch port to capture all traffic to and from the server.
   • DA NIDS placed on the BAS server's VLAN to watch for configuration changes.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A regional electrical utility operates a control center with a flat Ethernet network. The security team must detect two threats: (1) an insider who has physical access to a Windows-based engineering workstation and plans to modify the historian's database, and (2) an external attacker who has breached the corporate firewall and is sending malformed IEC 61850 packets to a protection relay. The team has a limited budget and can deploy only one type of sensor. Which sensor type provides the best combined coverage?

   • AA HIDS on the historian server.
   • BAn NNIDS on the protection relay's network link.
   • CA HIDS on the engineering workstation.
   • DA NIDS on the core switch with a SPAN port.
   Reveal Solution Discussion Select an answer first