What IDS Can and Cannot Do ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team at a pharmaceutical plant is evaluating the effectiveness of their network-based IDS. The IDS has a low false-positive rate, but the team suspects it is missing attacks. An investigation reveals that the IDS is not detecting attacks that use legitimate protocols, such as an attacker using a valid engineering workstation to send unauthorized commands. What is the most likely reason for this gap?

   • AThe IDS is an IPS and is blocking the traffic
   • BThe IDS lacks the contextual awareness to distinguish legitimate from malicious use of valid credentials
   • CThe IDS is not configured to monitor the correct network segment
   • DThe IDS has too many false positives, causing alerts to be ignored
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is tuning an IDS rule that detects unauthorized access to a historian database. The rule currently has a high false-positive rate because it triggers on legitimate read-only queries. The analyst wants to reduce false positives without missing real attacks. What is the best approach?

   • AIncrease the alert threshold to only trigger on high volume
   • BDisable the rule and rely on other detection methods
   • CAdd a whitelist for known legitimate source IPs and queries
   • DChange the rule to only trigger on write operations
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An ICS security team plans to deploy a network-based IDS to monitor traffic between the corporate network and the SCADA DMZ. Which placement would maximize the IDS's ability to detect external attacks?

   • AOn the internal PLC network, monitoring only traffic between PLCs
   • BOn the SCADA DMZ segment, monitoring traffic from the corporate network
   • COn the engineering workstation segment, monitoring only local traffic
   • DOn the same segment as the corporate user workstations
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large ICS environment has a mix of legacy and modern devices. The security team deploys a network-based IDS that uses both signature and anomaly detection. The IDS generates a high number of alerts for legitimate but unusual traffic patterns from a new PLC model. The team is concerned about missing real attacks due to alert fatigue. They have limited staff and cannot manually tune rules for every device. What is the best approach to reduce false positives while maintaining detection capability?

   • ADisable anomaly detection and rely only on signature-based detection.
   • BIncrease the alert threshold for all anomaly rules to reduce the number of alerts.
   • CMove the IDS to a different network segment where the new PLC is not present.
   • DCreate a baseline of normal traffic for the new PLC model and whitelist those patterns.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In an ICS network, an analyst notices that a security device is placed inline between the SCADA firewall and the switch, and it can drop malicious packets. Which type of device is this?

   • ASecurity Information and Event Management (SIEM) system
   • BNetwork tap
   • CIntrusion Detection System (IDS)
   • DIntrusion Prevention System (IPS)
   Reveal Solution Discussion Select an answer first