What IDS Can and Cannot Do ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An ICS security team is evaluating an IDS that uses a rule to detect a specific exploit in the EtherNet/IP protocol. The rule matches a byte pattern at a specific offset. An attacker sends the exploit but pads the payload with extra bytes, shifting the pattern. The IDS does not alert. What is the most likely reason?

   • AThe IDS is an IPS and is blocking the traffic before it can alert.
   • BThe IDS cannot handle the EtherNet/IP protocol.
   • CThe IDS signature is too specific and does not account for variations in the payload.
   • DThe IDS is not placed in the right network segment.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An ICS security analyst is tuning the IDS to reduce false positives. The analyst tightens the rules so that only exact matches to known exploit patterns generate alerts. What is the likely trade-off?

   • AFalse positives will decrease, but false negatives may increase.
   • BBoth false positives and false negatives will increase.
   • CFalse positives will increase, but false negatives will decrease.
   • DBoth false positives and false negatives will decrease.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A natural gas pipeline company has a network-based IDS placed on a SPAN port of the core switch that aggregates all OT traffic. The IDS is configured with a signature that detects a specific exploit in the DNP3 protocol. An attacker sends the exploit from a compromised laptop connected to the same switch. The IDS does not alert. What is the most likely cause?

   • AThe DNP3 traffic is encrypted, so the IDS cannot inspect it.
   • BThe SPAN port is not configured to capture traffic from the port where the laptop is connected.
   • CThe IDS signature is outdated and does not include the specific exploit.
   • DThe IDS is an IPS and is blocking the traffic before it can alert.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An ICS security team has an IDS that generates a high number of false positives due to legitimate broadcast traffic in the OT network. The team wants to reduce false positives without losing detection of malicious broadcast-based attacks. What is the best approach?

   • ACreate a whitelist for known legitimate broadcast sources and patterns.
   • BMove the IDS to a different network segment where broadcast traffic is not present.
   • CDisable all alerts for broadcast traffic.
   • DIncrease the alert threshold for all broadcast traffic.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which activity is a capability of an IDS deployed in an ICS environment?

   • ADetecting anomalous Modbus TCP queries that match a known attack signature
   • BPreventing unauthorized changes to PLC ladder logic
   • CEncrypting SCADA traffic to protect confidentiality
   • DQuarantining infected engineering workstations
   Reveal Solution Discussion Select an answer first