Surveillance & Monitoring Systems Flashcards
7 cards from real ICS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Surveillance & Monitoring Systems flashcards as text
Which ICS security framework recommends using 'conduits' as a concept to manage data flows between security zones in an OT environment?
Answer: IEC 62443
IEC 62443 defines the concept of zones and conduits, where conduits are the controlled pathways through which data flows between security zones.
An ICS operator receives an alert that a PLC's input values match expected ranges but its output actuators are behaving unexpectedly. What monitoring capability would best diagnose this?
Answer: Cross-correlating PLC input/output logs with physical process sensor readings
Cross-correlating controller logic outputs with independent physical sensors can reveal discrepancies indicating logic manipulation or actuator compromise.
What is 'deep packet inspection' (DPI) most useful for in ICS surveillance?
Answer: Analyzing the payload of industrial protocol messages to detect malicious commands
DPI enables inspection of industrial protocol payloads (e.g., Modbus function codes) to detect unauthorized commands that would appear normal at the packet header level.
In the PURDUE model for ICS architecture, which level contains the SCADA servers and historians that aggregate monitoring data?
Answer: Level 3 – Manufacturing Operations Management
Level 3 of the Purdue model houses SCADA servers, historians, and manufacturing execution systems that collect and store process monitoring data.
Which threat does 'replay attack' monitoring specifically address in ICS environments?
Answer: An attacker re-transmitting previously captured legitimate control messages to cause unintended actions
Replay attacks involve capturing and re-sending valid ICS messages at a later time to trick controllers into executing unintended commands.
What is the key difference between 'active' and 'passive' network monitoring in an ICS environment?
Answer: Active monitoring sends probe traffic to devices, while passive monitoring only observes existing traffic
Active monitoring queries devices to gather status, while passive monitoring silently captures and analyzes traffic without injecting probe packets that could disrupt ICS operations.
A manufacturing plant's ICS monitoring system generates a 'golden image' of all PLC ladder logic. What is the primary security purpose of this practice?
Answer: Enabling integrity verification to detect unauthorized logic changes
A golden image baseline allows security teams to detect any unauthorized modifications to PLC logic by comparing current state against the known-good reference.