ICS Security Network Architecture and Protocols

Question 1

What is the purpose of a demilitarized zone (DMZ) in an ICS network?

Accepted Answer

Isolates ICS from external networks

Answer

A Demilitarized Zone (DMZ) in an ICS network serves as a buffer zone, providing an additional layer of security between the highly sensitive operational technology (OT) network and less secure external networks, such as the enterprise IT network or the internet. It hosts systems that need to communicate with both environments, like historians or data servers. This isolation protects critical ICS components from direct external access and reduces the attack surface.

Question 2

Which protocol is commonly used for communication in SCADA systems?

Accepted Answer

Modbus

Answer

Modbus is one of the oldest and most widely used serial communication protocols in SCADA (Supervisory Control and Data Acquisition) systems and other industrial control applications. It allows devices like PLCs, RTUs, and sensors to communicate with each other and with supervisory systems. Despite its age, Modbus remains prevalent due to its simplicity and widespread adoption, though it lacks inherent security features.

Question 3

What is the main function of a programmable logic controller (PLC)?

Accepted Answer

Control industrial machinery

Answer

A Programmable Logic Controller (PLC) is a specialized industrial computer that automates control processes in factories and industrial plants. Its main function is to receive input signals from sensors, execute programmed logic, and send output signals to actuators to control industrial machinery and processes. PLCs are fundamental components of modern industrial automation systems, ensuring precise and reliable operation.

Question 4

What is a common vulnerability of legacy ICS protocols?

Accepted Answer

Lack of security features

Answer

Many legacy ICS protocols, such as older versions of Modbus or DNP3, were designed in an era when security was not a primary concern and systems were often air-gapped. Consequently, they commonly lack modern security features like authentication, encryption, or integrity checks. This inherent vulnerability makes them susceptible to various attacks, including eavesdropping, tampering, and unauthorized control, without built-in protections.

Question 5

Which layer of the OSI model does the TCP protocol operate on?

Accepted Answer

Transport

Answer

The Transmission Control Protocol (TCP) operates at the Transport layer (Layer 4) of the OSI model. Its primary function is to provide reliable, ordered, and error-checked delivery of a stream of octets between applications running on hosts communicating over an IP network. TCP ensures that data segments are delivered correctly and in sequence, managing connection establishment and termination.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Security Network Architecture and Protocols