What IDS Can and Cannot Do ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   An ICS security team deploys an IDS to monitor traffic between the HMI and PLCs. Which limitation of the IDS should the team account for?

   • AIt can guarantee detection of all zero-day exploits targeting the PLCs
   • BIt will block all traffic that matches a known exploit signature
   • CIt can decrypt TLS-encrypted HMI traffic to inspect the payload
   • DIt can detect but not prevent an attack that is already underway
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is evaluating a new IDS for an OT environment. The vendor claims the IDS can detect 'all known and unknown attacks.' What should the analyst conclude?

   • AThe claim is true if the IDS uses both signature and anomaly detection.
   • BThe claim is plausible because modern IDS use machine learning.
   • CThe claim is true if the IDS is placed inline.
   • DThe claim is false because no IDS can detect all attacks, especially zero-day exploits.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A manufacturing company has a network-based IDS that monitors the OT network. The security team wants to detect a new, unknown malware that is spreading through the network using a proprietary protocol. What is the most realistic expectation of the IDS's ability?

   • AThe IDS will not detect the malware because it has no signature for it
   • BThe IDS will block the malware because it is an IPS
   • CThe IDS will detect the malware because it monitors all traffic
   • DThe IDS will detect the malware because it uses anomaly detection
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A water treatment plant has a network-based IDS that is not detecting attacks because the SPAN port is oversubscribed and drops packets during high traffic. What is the most effective solution?

   • AIncrease the IDS's alert threshold
   • BUse a network tap instead of a SPAN port
   • CMove the IDS to a different switch
   • DReduce the amount of traffic monitored by filtering the SPAN port
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst at a natural gas pipeline company is tuning the IDS rules. After increasing the sensitivity of a rule that detects unauthorized Modbus writes, the IDS now generates hundreds of alerts per day, most of which are legitimate maintenance activities. The analyst is concerned that operators will miss a real attack. What is the best course of action?

   • AKeep the high sensitivity and require operators to review all alerts
   • BDisable the rule entirely to eliminate false positives
   • CReduce the sensitivity until the false-positive rate is acceptable, while still detecting known attack patterns
   • DReplace the IDS with an IPS to block the maintenance traffic
   Reveal Solution Discussion Select an answer first