What IDS Can and Cannot Do ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A water treatment facility uses a network-based IDS that relies on signatures for known exploits. An attacker uses a previously unknown vulnerability in the HMI software to send a crafted packet that causes the HMI to crash. The IDS does not alert. What is the most likely reason?

   • AThe IDS is configured to ignore traffic from the HMI because it is a trusted device.
   • BThe IDS has no signature for a zero-day exploit, so it cannot detect the attack.
   • CThe IDS is not placed in the right network segment to see the traffic.
   • DThe IDS cannot detect attacks that use valid protocol commands.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A water utility has a network-based IDS placed on a tap between the SCADA server and the PLC network. The IDS is configured to detect Modbus anomalies. The security team notices that the IDS does not see any traffic from the engineering workstation that is on a separate VLAN but routed through the same switch. What is the most likely reason?

   • AThe engineering workstation traffic is encrypted.
   • BThe tap is only monitoring the link between the SCADA server and PLC network, not the VLAN traffic.
   • CThe IDS is not configured to decode Modbus traffic.
   • DThe IDS is an IPS and is blocking the traffic.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A hospital's ICS network uses a network-based IDS. The security team is evaluating whether the IDS can detect an attacker who has gained control of a nurse's workstation and is using a legitimate remote desktop protocol (RDP) session to access the building management system. What is the most accurate assessment of the IDS's ability in this scenario?

   • AThe IDS can block the RDP session if it matches a known attack signature
   • BThe IDS can detect the RDP session and alert, but it cannot determine if the session is malicious
   • CThe IDS cannot detect the RDP session because it is encrypted
   • DThe IDS will detect the attack because it uses a known protocol
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A power utility has a network-based IDS monitoring the DMZ between the corporate network and the control network. The security team wants to automatically stop a known malware signature from spreading to the control network. What should they do?

   • ADeploy an IPS in inline mode at the same DMZ point
   • BMove the IDS to the control network core switch
   • CConfigure the IDS to send alerts to the SIEM
   • DAdd a more specific IDS rule to reduce false positives
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security analyst at a natural gas pipeline is tuning the IDS. The IDS currently has a high false-positive rate, causing operators to ignore alerts. The analyst must reduce false positives, but the operations team requires that no legitimate maintenance activity be blocked or delayed. The analyst is considering increasing the threshold for a specific rule that detects unusual Modbus writes. What is the most important trade-off to consider?

   • AIncreasing the threshold will block legitimate maintenance activity
   • BIncreasing the threshold will increase the IDS's processing speed
   • CIncreasing the threshold may cause false negatives for low-volume attacks
   • DIncreasing the threshold will eliminate all false positives
   Reveal Solution Discussion Select an answer first