What IDS Can and Cannot Do ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An ICS security team has tuned their IDS to be very sensitive, resulting in a high number of alerts. The team is overwhelmed and has started ignoring alerts. What is the most likely consequence?

   • AThe IDS will block legitimate traffic because it is too sensitive.
   • BA real attack may be missed because the team is desensitized to alerts.
   • CThe IDS will automatically disable rules that generate too many alerts.
   • DThe IDS will generate more false negatives because the rules are too broad.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which deployment consideration is most important for a network-based IDS to effectively detect threats in an ICS environment?

   • AUsing a wireless connection for the IDS sensor to avoid cabling costs
   • BPlacing the IDS sensor on a segment where it can see the traffic of interest
   • CConfiguring the IDS to block all traffic that matches a signature
   • DPlacing the IDS on the same host as the HMI to save hardware costs
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A power plant has a network-based IDS placed on a SPAN port of the core switch. The security team is concerned about attacks that use fragmented IP packets to evade detection. What is the most effective way to improve the IDS's ability to detect such attacks?

   • AIncrease the alert threshold to reduce false positives
   • BUse a signature that matches the first fragment only
   • CEnable the IDS's defragmentation and reassembly features
   • DMove the IDS to a different SPAN port
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An ICS security analyst deploys a network-based IDS at the boundary between the corporate network and the SCADA DMZ. Which core function will this IDS perform?

   • AReplace the firewall by enforcing access control policies
   • BMonitor network traffic and generate alerts when suspicious activity is detected
   • CDecrypt all encrypted traffic to inspect payloads for malware
   • DAutomatically block malicious traffic before it reaches the SCADA network
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A chemical plant has an IDS that monitors the control network. The security manager wants to automatically block a specific IP address that is sending malformed packets to a PLC. What is the most appropriate action?

   • AConfigure the IDS to send an alert to the security team
   • BDeploy an IPS inline and configure a rule to drop traffic from that IP
   • CAdd a firewall rule to block the IP
   • DMove the IDS to a different network segment
   Reveal Solution Discussion Select an answer first