What IDS Can and Cannot Do ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A manufacturing plant has a network-based IDS that has been generating a high volume of false positives, causing operators to miss a real attack. The security manager wants to reduce false positives without losing the ability to detect real attacks. The plant's OT network has a mix of legacy and modern protocols, and some traffic is encrypted. What is the best approach?

   • AIncrease the IDS's sensitivity to catch more attacks
   • BDisable the IDS and rely on manual monitoring
   • CTune the IDS rules to reduce false positives, and add a separate IPS to block known attacks
   • DReplace the IDS with an IPS to automatically block all suspicious traffic
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary difference between an IDS and an IPS?

   • AAn IDS is deployed inline, while an IPS is deployed out-of-band
   • BAn IPS only monitors traffic, while an IDS can block malicious packets
   • CAn IDS can decrypt encrypted traffic, while an IPS cannot
   • DAn IDS only detects and alerts, while an IPS can actively block or prevent threats
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which statement correctly describes an inherent limitation of an IDS?

   • AIt can replace the need for network segmentation in ICS environments
   • BIt cannot inspect the contents of encrypted traffic without additional decryption mechanisms
   • CIt can detect all zero-day exploits because it uses behavioral analysis
   • DIt can actively block malicious packets before they reach the target
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An ICS security analyst is investigating a suspected breach. The network-based IDS did not alert on any malicious activity, but a host-based forensic analysis reveals that a PLC was reprogrammed with malicious logic. The traffic between the engineering workstation and the PLC was encrypted using a proprietary protocol. What is the most likely reason the IDS did not alert?

   • AThe IDS was placed in a location that did not see the traffic.
   • BThe IDS signature for the malicious logic was not up to date.
   • CThe IDS cannot inspect encrypted traffic, so it missed the malicious commands.
   • DThe IDS was not configured to monitor the specific port used by the proprietary protocol.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A water treatment facility uses a network-based IDS to monitor the control network. The security team notices that the IDS generates alerts for normal Modbus polling traffic, causing operators to ignore alerts. Meanwhile, an attacker uses a legitimate engineering workstation to send unauthorized set-point changes over an encrypted SSH tunnel, and the IDS does not alert. Which two limitations of the IDS are most directly demonstrated in this scenario?

   • AInability to detect zero-day exploits and inability to prevent attacks
   • BInability to prevent attacks and inability to detect attacks over encrypted traffic
   • CInability to detect attacks over encrypted traffic and susceptibility to false positives from legitimate traffic
   • DSusceptibility to false negatives from rule tuning and inability to handle high-bandwidth traffic
   Reveal Solution Discussion Select an answer first