Detection in an ICS Environment GRID Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A water utility has a flat Layer 2 network for its SCADA system. The security team wants to deploy a monitoring solution that can see all traffic without disrupting operations. They are considering a passive network tap, a SPAN port, and an active scanner. The network switch is a managed industrial switch. What is the most appropriate monitoring approach?

   • AConfigure a SPAN port on the switch to mirror all traffic to a passive monitoring appliance.
   • BInstall a network tap on the uplink between the SCADA network and the corporate network only.
   • CUse the switch's built-in logging to record all traffic flows.
   • DDeploy an active scanner on the network to identify all devices and their vulnerabilities.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of an ICS asset that should be included in an asset inventory?

   • AA cloud-based customer relationship management (CRM) system
   • BA marketing department's laptop
   • CA corporate email server
   • DA programmable logic controller (PLC) on the plant floor
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A power generation facility has a DNP3 network with a control center and 50 RTUs. The security team has been passively monitoring traffic for three months. The baseline shows that each RTU sends a heartbeat message every 5 seconds and responds to polls with function code 1. The team notices that RTU 17 has started sending heartbeat messages every 2 seconds, and its responses to polls include an extra object (0x32, Analog Input) that was not in the baseline. The RTU is located at a remote substation. The team also sees a new IP address communicating with RTU 17 on port 20000, which is not the control center. What is the most likely scenario?

   • AA network engineer is performing routine maintenance on RTU 17 and changed its configuration.
   • BRTU 17 has been compromised, and the attacker is using a new IP address to communicate with it and alter its reporting behavior.
   • CThe RTU is malfunctioning and needs to be rebooted.
   • DThe control center has updated its polling configuration to include RTU 17's new data.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A water treatment facility uses Modbus TCP to communicate between a SCADA server and multiple PLCs. During a routine review of packet captures, an analyst notices a series of Modbus requests from the SCADA server to a specific PLC that read holding registers at addresses 40001 through 40010 every 5 seconds. The analyst also sees a single request to write to coil address 00001 from the same SCADA server. The facility's asset inventory lists this PLC as a remote terminal unit (RTU) that only supports DNP3, not Modbus. What is the most likely explanation for this traffic pattern?

   • AThe PLC is actually a Modbus-to-DNP3 gateway, and the traffic is normal protocol conversion.
   • BThe traffic indicates a potential unauthorized device or a compromised SCADA server communicating with an asset that should not be using Modbus.
   • CThe SCADA server is performing a legitimate maintenance operation on the PLC.
   • DThe traffic is a normal part of the SCADA server's polling cycle, and the write is a configuration change.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In ICS protocol anomaly detection, which of the following would be considered an anomaly in Modbus communications?

   • AA function code that is not supported by the target device model
   • BA request that uses the standard TCP port 502
   • CA normal read request for a register that is within the device's defined range
   • DA response that arrives within the expected time window
   Reveal Solution Discussion Select an answer first