Types of IDS (Network, Host, Network Node) ICSSCADA Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A water treatment facility has multiple PLCs on a flat Layer 2 network segment. The security team wants to detect malicious traffic such as unauthorized Modbus writes before they reach the PLCs. They have limited budget and cannot install agents on the PLCs. Which deployment would best meet their need?

   • AInstall a host-based IDS (HIDS) on each PLC to monitor local logs and file integrity.
   • BUse a passive tap on the serial link between the RTU and the master station only.
   • CDeploy a network-based IDS (NIDS) with a SPAN port on the switch that carries the PLC traffic.
   • DPlace a network node IDS (NNIDS) on the engineering workstation to monitor its own traffic.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a common limitation of a network-based IDS (NIDS) when deployed in a switched network?

   • AIt may not see all traffic unless the switch is configured to mirror traffic to the sensor
   • BIt consumes significant CPU and memory on each monitored host
   • CIt cannot analyze any network protocols used in ICS environments
   • DIt cannot detect attacks that originate from outside the network
   Reveal Solution Discussion Select an answer first
3. 23foundation · easy

   Which advantage is unique to a host-based IDS (HIDS) compared to a network-based IDS (NIDS)?

   • AIt can detect local attacks that do not generate network traffic, such as unauthorized file modifications
   • BIt can monitor traffic on multiple network segments from a single sensor
   • CIt can inspect encrypted traffic without any additional configuration
   • DIt does not require any software installation on the monitored host
   Reveal Solution Discussion Select an answer first