ICS Surveillance & Monitoring Systems 4

Question 1

Which ICS security framework recommends using 'conduits' as a concept to manage data flows between security zones in an OT environment?

Accepted Answer

IEC 62443

Answer

IEC 62443 defines the concept of zones and conduits, where conduits are the controlled pathways through which data flows between security zones.

Question 2

An ICS operator receives an alert that a PLC's input values match expected ranges but its output actuators are behaving unexpectedly. What monitoring capability would best diagnose this?

Accepted Answer

Cross-correlating PLC input/output logs with physical process sensor readings

Answer

Cross-correlating controller logic outputs with independent physical sensors can reveal discrepancies indicating logic manipulation or actuator compromise.

Question 3

What is 'deep packet inspection' (DPI) most useful for in ICS surveillance?

Accepted Answer

Analyzing the payload of industrial protocol messages to detect malicious commands

Answer

DPI enables inspection of industrial protocol payloads (e.g., Modbus function codes) to detect unauthorized commands that would appear normal at the packet header level.

Question 4

In the PURDUE model for ICS architecture, which level contains the SCADA servers and historians that aggregate monitoring data?

Accepted Answer

Level 3 – Manufacturing Operations Management

Answer

Level 3 of the Purdue model houses SCADA servers, historians, and manufacturing execution systems that collect and store process monitoring data.

Question 5

Which threat does 'replay attack' monitoring specifically address in ICS environments?

Accepted Answer

An attacker re-transmitting previously captured legitimate control messages to cause unintended actions

Answer

Replay attacks involve capturing and re-sending valid ICS messages at a later time to trick controllers into executing unintended commands.

(ICS) Industrial Control Systems Security Certification Practice Test

(ICS) Industrial Control Systems Security Certification Practice Test

ICS Surveillance & Monitoring Systems 4