A security architect for a large multinational manufacturer - CompTIA CAS-005

Correct Answer: B. Use of any non-DNP3 communication on a DNP3 port

The DNP3 protocol is commonly used in industrial control systems (ICS), particularly for SCADA (Supervisory Control and Data Acquisition) systems. If any communication on a DNP3 port deviates from the expected DNP3 protocol, it could indicate an attack or unauthorized access attempt, such as an intrusion or exploitation of a vulnerability.

Focusing on non-DNP3 communication on a DNP3 port ensures that the security solution specifically monitors for abnormal or malicious traffic directed at critical infrastructure components using a non-compliant protocol. This is especially crucial for protecting ICS environments, which rely heavily on specific communication protocols for control and monitoring.

Why the other options are incorrect:

• Packets that are the wrong size or length:
  While packet size anomalies might indicate a potential attack or misconfiguration, this is not as specific or directly tied to an ICS environment like DNP3. Generic packet size issues may not always indicate a malicious attack or targeted threat.

• Multiple solicited responses over time:
  Multiple solicited responses (where responses are received for a request over time) could indicate a DoS (Denial of Service) or a flooding attack. However, this threat is more relevant to network performance rather than a specific attack against industrial control systems using DNP3. While it's important to monitor traffic for anomalies, this doesn't directly address the primary threat for an industrial network.

• Application of an unsupported encryption algorithm:
  The use of unsupported encryption algorithms could present a security risk, especially in traditional IT environments. However, it is not as relevant to ICS or DNP3 traffic. DNP3 typically uses specific, well-defined methods for securing communication, and monitoring for encryption algorithm weaknesses might be secondary to ensuring protocol-specific attacks (like non-DNP3 communication) are blocked.