Surveillance & Monitoring Systems Flashcards
7 cards from real ICS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Surveillance & Monitoring Systems flashcards as text
Which network architecture practice BEST protects ICS monitoring systems from cyber threats originating on the corporate IT network?
Answer: Implementing a demilitarized zone (DMZ) between IT and OT networks
A DMZ acts as a buffer zone, controlling data flows between the untrusted corporate network and the critical OT monitoring environment.
In ICS monitoring, what is a 'data diode' used for?
Answer: Allowing data to flow in only one direction, from OT to IT, without any return path
A data diode is a hardware-enforced unidirectional gateway that ensures data can only travel from the ICS network outward, eliminating the return attack path.
An operator notices that a flow meter reading in the SCADA HMI has been constant for 6 hours without variation. What security concern should this raise?
Answer: A sensor or its data feed may have been spoofed or frozen by an attacker
A perfectly flat reading over an extended period is a hallmark indicator of sensor spoofing or data substitution attacks targeting ICS monitoring.
What is the purpose of 'out-of-band' monitoring in ICS security surveillance?
Answer: Using a separate, dedicated network to monitor ICS devices without traversing the operational network
Out-of-band monitoring uses a dedicated management network so that surveillance traffic does not interfere with or traverse the production ICS network.
Which type of ICS monitoring system is specifically designed to detect anomalies by establishing a behavioral baseline of normal OT network communications?
Answer: OT-specific Intrusion Detection System (IDS) with passive monitoring
OT-specific passive IDS tools learn normal communication patterns between ICS devices and alert on deviations without disrupting real-time control traffic.
A security engineer is reviewing camera placements at a water treatment facility. Which location should receive the HIGHEST monitoring priority from a security standpoint?
Answer: Chemical dosing control panels and pump control rooms
Chemical dosing and pump control areas represent the highest-consequence physical access points because tampering could directly impact public safety.
What logging feature is most critical for forensic investigation of a suspected ICS cyberattack that manipulated sensor readings?
Answer: Tamper-evident, time-synchronized logs stored on a write-once medium or remote SIEM
Tamper-evident logs with precise time synchronization stored off the compromised system are essential for reliable forensic reconstruction of attack timelines.