What IDS Can and Cannot Do ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An ICS security analyst notices that the IDS generates hundreds of alerts per day for 'Modbus function code 90' (which is not a standard function code) from a particular vendor's HMI. After investigation, the analyst confirms these are normal heartbeat messages from the HMI. The analyst wants to reduce noise while still detecting real attacks. What should the analyst do?

   • ACreate a whitelist rule that suppresses alerts for this specific HMI IP address and function code combination.
   • BIncrease the alert threshold so that the IDS only alerts if the function code appears more than 100 times per minute.
   • CMove the IDS to a different network segment so it no longer sees the HMI traffic.
   • DDisable the signature for Modbus function code 90 entirely.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A water utility has a network-based IDS monitoring the SCADA network. The security team wants to detect attacks that originate from the corporate network and target the PLCs. The corporate network uses a mix of encrypted and unencrypted protocols. The team is considering placing the IDS at the boundary between the corporate and SCADA networks, or inside the SCADA network. What is the best placement to maximize detection of these attacks?

   • AOn the corporate network's internet gateway
   • BBoth at the boundary and inside the SCADA network
   • CAt the boundary, monitoring all traffic between the networks
   • DInside the SCADA network, monitoring traffic to the PLCs
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A large ICS environment has multiple network segments, including a DMZ, a control network, and a field network. The security team wants to deploy IDS sensors to monitor all segments. They have a limited budget and can only deploy a few sensors. What is the most important consideration when deciding where to place the sensors?

   • APlace sensors on the least critical segments to avoid false positives.
   • BPlace sensors on the network core to see all traffic.
   • CPlace sensors on the most critical assets, such as PLCs and HMIs.
   • DPlace sensors at the boundaries between segments to monitor all cross-segment traffic.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the impact of a high rate of false positives on an IDS deployment in an ICS environment?

   • AThe IDS will consume more bandwidth on the network
   • BThe IDS will be unable to decrypt encrypted traffic
   • CThe IDS will automatically block legitimate SCADA traffic
   • DAnalysts may become desensitized to alerts and miss real attacks
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A water utility deployed a network-based IDS at the boundary between the IT and OT networks. The security team notices that the IDS generates no alerts for a series of malicious Modbus commands that originate from a compromised engineering workstation and are sent to a PLC. The commands are valid Modbus function codes but use unusual register addresses. What is the most likely reason the IDS failed to alert?

   • AThe IDS is unable to detect attacks that use valid protocol function codes, even if the values are anomalous.
   • BThe IDS is placed in a location where it cannot see the traffic between the workstation and the PLC.
   • CThe IDS is configured to only alert on known CVE-based exploits and not on any zero-day attacks.
   • DThe IDS cannot decrypt the Modbus payload because it is encrypted with TLS.
   Reveal Solution Discussion Select an answer first