ICS Security Network Architecture and Protocols 2 — Questions and Answers
Question 1: Which ICS protocol transmits data in plaintext and is therefore considered inherently insecure?
- DNP3 Secure Authentication
- Modbus TCP (Correct answer)
- IEC 62351-secured ICCP
- OPC UA with TLS
Correct answer: Modbus TCP
Modbus TCP lacks built-in authentication or encryption, transmitting all data in plaintext.
Question 2: What is the primary purpose of a demilitarized zone (DMZ) in an ICS network architecture?
- To host historian servers accessible from both OT and IT networks (Correct answer)
- To provide wireless connectivity for field devices
- To run real-time control logic close to PLCs
- To replace the need for firewalls between zones
Correct answer: To host historian servers accessible from both OT and IT networks
An ICS DMZ hosts shared services like historians so neither the IT nor OT network directly communicates with the other.
Question 3: In the Purdue Reference Model, which level hosts supervisory control functions such as SCADA servers and HMIs?
- Level 0
- Level 1
- Level 2 (Correct answer)
- Level 3
Correct answer: Level 2
Level 2 of the Purdue Model is the Supervisory Control level, housing SCADA systems and HMIs.
Question 4: A defense-in-depth strategy for ICS networks primarily relies on which concept?
- Single strong perimeter firewall
- Layered security controls across multiple zones (Correct answer)
- Air-gapping all OT devices permanently
- Encrypting only historian communications
Correct answer: Layered security controls across multiple zones
Defense-in-depth applies multiple overlapping security controls so that failure of one layer does not compromise the entire system.
Question 5: Which protocol is commonly used for secure remote access tunneling into ICS environments?
- Telnet
- FTP
- IPsec VPN (Correct answer)
- TFTP
Correct answer: IPsec VPN
IPsec VPN provides encrypted, authenticated tunnels for secure remote access into ICS environments.
Question 6: What network segmentation technique uses VLAN tagging to separate OT traffic from IT traffic on shared switches?
- ACL-based filtering
- IEEE 802.1Q (Correct answer)
- OSPF route redistribution
- MAC flooding prevention
Correct answer: IEEE 802.1Q
IEEE 802.1Q VLAN tagging allows logical separation of OT and IT traffic on shared physical network infrastructure.
Question 7: Which attack targets ICS networks by exploiting the lack of authentication in legacy SCADA protocols to issue unauthorized commands?
- SQL injection
- Replay attack
- Spoofed command injection (Correct answer)
- DNS cache poisoning
Correct answer: Spoofed command injection
Spoofed command injection exploits unauthenticated legacy protocols to send fake control commands to PLCs or RTUs.
ICS Security Network Architecture and Protocols 2
Which ICS protocol transmits data in plaintext and is therefore considered inherently insecure?