ICS Surveillance & Monitoring Systems 2 — Questions and Answers
Question 1: Which protocol is most commonly used by IP-based surveillance cameras in ICS environments for video streaming?
- RTSP (Real Time Streaming Protocol) (Correct answer)
- Modbus TCP
- DNP3
- PROFINET
Correct answer: RTSP (Real Time Streaming Protocol)
RTSP is the standard protocol used by IP cameras to stream video feeds over networks in ICS surveillance deployments.
Question 2: An ICS security team wants to detect unauthorized physical access to a substation. Which monitoring approach provides the BEST audit trail?
- Deploying badge-reader logs integrated with SIEM (Correct answer)
- Installing motion-activated floodlights
- Using perimeter fencing alone
- Posting security guards at all times
Correct answer: Deploying badge-reader logs integrated with SIEM
Badge-reader logs integrated with a SIEM provide timestamped, identity-linked records suitable for forensic audit trails.
Question 3: What is the primary security risk of connecting an IP surveillance camera directly to an ICS control network without segmentation?
- Cameras can serve as pivot points for attackers to reach control systems (Correct answer)
- Camera footage quality degrades
- Bandwidth usage increases on the control network
- Cameras require additional licensing fees
Correct answer: Cameras can serve as pivot points for attackers to reach control systems
Unsegmented cameras expand the attack surface, allowing a compromised camera to be used as a pivot point to attack PLCs and controllers.
Question 4: In ICS environments, what does 'alarm fatigue' in monitoring systems refer to?
- Operators becoming desensitized to alerts due to excessive false positives (Correct answer)
- Physical wear on alarm hardware components
- Network congestion caused by too many alert packets
- Alarms that automatically reset after a timeout period
Correct answer: Operators becoming desensitized to alerts due to excessive false positives
Alarm fatigue occurs when an overwhelming number of alerts—especially false positives—causes operators to ignore or miss critical alarms.
Question 5: Which NERC CIP standard specifically addresses physical security perimeter monitoring requirements for bulk electric systems?
- NERC CIP-006 (Correct answer)
- NERC CIP-002
- NERC CIP-010
- NERC CIP-013
Correct answer: NERC CIP-006
NERC CIP-006 defines requirements for physical security of cyber systems, including monitoring of physical security perimeters.
Question 6: A SCADA historian is configured to store process data at 1-second intervals. What security concern does this high-resolution data logging introduce?
- Detailed operational fingerprinting that could be exploited by adversaries who gain access (Correct answer)
- Reduced system performance due to excessive CPU usage
- Incompatibility with legacy HMI interfaces
- Automatic deletion of older data records
Correct answer: Detailed operational fingerprinting that could be exploited by adversaries who gain access
High-resolution historian data can reveal precise operational patterns, setpoints, and vulnerabilities if accessed by an unauthorized party.
Question 7: What is the recommended approach when a surveillance camera firmware update is available in an ICS environment?
- Test the update in a staging environment before deploying to production cameras (Correct answer)
- Apply the update immediately to all cameras simultaneously
- Skip firmware updates to avoid disrupting surveillance coverage
- Outsource all firmware updates to the camera vendor without internal review
Correct answer: Test the update in a staging environment before deploying to production cameras
Firmware updates should be validated in a test environment first to ensure they do not introduce compatibility issues or vulnerabilities.
ICS Surveillance & Monitoring Systems 2
Which protocol is most commonly used by IP-based surveillance cameras in ICS environments for video streaming?