Firewall and DMZ for SCADA in SCADA systems - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a firewall rule that allows SCADA traffic on port 502.

SCADA systems

firewall_rule = "allow tcp port [1] from any to scada_network"

Drag options to blanks, or click blank then click option'

A80

B502

C22

D443

Attempts:

3 left

💡 Hint

Common Mistakes

Using HTTP port 80 instead of SCADA port 502.

Confusing SSH port 22 with SCADA traffic port.

Port 502 is the standard port for Modbus TCP, commonly used in SCADA systems.

2fill in blank

medium

Complete the code to specify the DMZ network segment for SCADA devices.

SCADA systems

dmz_network = "[1].0.0/24"

Drag options to blanks, or click blank then click option'

A192.168

B192

C172

D10

Attempts:

3 left

💡 Hint

Common Mistakes

Using '192.168' which is two octets instead of one.

Confusing the subnet mask with the network address.

The 10.0.0.0/24 subnet is often used for private networks including DMZ segments.

3fill in blank

hard

Fix the error in the firewall rule to block all traffic except SCADA on port 502.

SCADA systems

firewall_rule = "block all except tcp port [1]"

Drag options to blanks, or click blank then click option'

A80

B23

C502

D3389

Attempts:

3 left

💡 Hint

Common Mistakes

Allowing Telnet port 23 instead of SCADA port 502.

Allowing HTTP port 80 which is unrelated to SCADA.

Port 502 is the correct port to allow SCADA traffic while blocking others.

4fill in blank

hard

Fill both blanks to create a firewall rule that allows SCADA traffic from the DMZ to the control network.

SCADA systems

firewall_rule = "allow tcp port [1] from [2] to control_network"

Drag options to blanks, or click blank then click option'

A502

B10.0.0.0/24

C192.168.1.0/24

D22

Attempts:

3 left

💡 Hint

Common Mistakes

Using SSH port 22 instead of SCADA port 502.

Using the control network IP as source instead of DMZ subnet.

Port 502 is for SCADA traffic, and 10.0.0.0/24 is the DMZ subnet sending traffic to the control network.

5fill in blank

hard

Fill all three blanks to define a firewall rule that blocks all traffic except SCADA on port 502 from the DMZ to the control network.

SCADA systems

firewall_rule = "block all except tcp port [1] from [2] to [3]"

Drag options to blanks, or click blank then click option'

A10.0.0.0/24

Bcontrol_network

C502

D192.168.1.0/24

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up source and destination networks.

Using wrong port numbers like 22 or 80.

Port 502 is the SCADA port, 10.0.0.0/24 is the DMZ subnet, and control_network is the destination network.