NPCBL Engineer Exam 11 July 2026 — Question Solution | নিউক্লিয়ার পাওয়ার প্ল্যান্ট কোম্পানি (এনপিসিবিএল) প্রকৌশলী নিয়োগ পরীক্ষা ২০২৬ — প্রশ্ন সমাধান

What an IDS is. An Intrusion Detection System (IDS) monitors network traffic or host activity for signs of attack or policy violation and raises alerts for analysts. (An IPS sits inline and can also block.)

• NIDS (network-based): watches packets on a network segment through a TAP or switch SPAN port – e.g. Snort, Suricata, Zeek.
• HIDS (host-based): watches one computer's logs, files, processes and USB events – e.g. Wazuh/OSSEC.
• Detection methods: signature-based (known attack patterns), anomaly-based (deviation from a learned baseline) and allow-list / specification-based (anything not explicitly permitted is an alert – very effective on stable industrial networks).

Why NPCBL is special

NPCBL operates the Rooppur Nuclear Power Plant, so it has two very different worlds:

• Corporate IT: e-mail, ERP, HR, internet access – similar to any company.
• Operational technology (OT): instrumentation and control (I&C), plant process computers, PLCs, and safety and physical-protection systems. Here availability and integrity come first, and a security tool must never disturb a safety function.

Following the IAEA's computer-security guidance for nuclear facilities (Nuclear Security Series No. 17-T, Rev. 1), systems are grouped into zones with graded security levels, and the most critical zones send data only outward through one-way gateways (data diodes).

How I would use IDS at NPCBL (step by step)

1. Inventory and baseline: list every digital asset, IP/MAC, protocol and normal flow in each zone; OT traffic is very predictable, so the baseline is precise.
2. Placement:
   • Internet edge and corporate LAN: NIDS plus an inline IPS (blocking is acceptable here).
   • DMZ (historian copy, update and patch servers): NIDS on every flow.
   • OT control network: passive NIDS only, fed by a network TAP – no inline blocking, no active scanning, so plant control is never delayed.
   • Highest-security (safety) zone: no inbound connections at all; monitoring through one-way data paths and host checks during maintenance.
3. Detection rules for OT: alert on any new device, any new connection pair, engineering commands (PLC write, firmware or logic download) from a non-engineering host or outside an approved maintenance window, and any traffic to the internet. Example Snort rule (illustrative):

   alert tcp !$ENG_WS any -> $PLC_NET 502 (msg:"OT: Modbus/TCP from non-engineering host"; flow:to_server,established; sid:1000001; rev:1;)
   

4. HIDS on engineering workstations and servers: file-integrity monitoring, new services, failed logins and removable-media (USB) use, a known path into isolated networks.
5. Central monitoring: send all alerts to a SIEM in a 24×7 Security Operations Centre (SOC); correlate them with firewall, data-diode and access-control logs.
6. Response: written playbooks; in OT every action is agreed with the shift supervisor so that isolation never upsets plant safety; incidents are escalated under the plant's computer-security plan and reported as national rules require.
7. Tuning and testing: remove false positives, update signatures via scanned, approved media, and test detection with drills and authorised penetration tests.

graph LR
    INET["Internet"] --> FW["Firewall + IPS"]
    FW --> IT["Corporate IT LAN (NIDS)"]
    IT --> DMZ["DMZ: historian copy (NIDS)"]
    OT["OT control network (passive NIDS via TAP)"] -->|"one-way data diode"| DMZ
    SAF["Safety I&C zone (no inbound links)"] -->|"one-way"| OT
    IT -. "alerts" .-> SIEM["SIEM / SOC"]
    DMZ -. "alerts" .-> SIEM
    OT -. "alerts" .-> SIEM

Aspect	Corporate IT	Plant OT
Mode	IDS + inline IPS	Passive IDS (detect only)
Main method	Signatures + threat intelligence	Allow-list / anomaly on a fixed baseline
Priority	Confidentiality	Availability and integrity (safety)
Response	Automatic blocking allowed	Manual, coordinated with operators

Exam tip: stress "passive IDS in OT, IPS only in IT", allow-list baselining, data diodes between zones, and a SIEM/SOC with a safety-aware response plan.

IPv4 uses 32-bit addresses and is the original Internet Protocol; IPv6 uses 128-bit addresses and was designed to end IPv4 address exhaustion, simplify packet processing and build security and auto-configuration into the protocol.

Part 1: IPv4 vs IPv6

Feature	IPv4	IPv6
Address length	32 bits	128 bits
Address space	2³² ≈ 4.3 × 10⁹	2¹²⁸ ≈ 3.4 × 10³⁸
Notation	Dotted decimal, e.g. 192.0.2.15	8 hex groups with colons, e.g. 2001:db8::15
Header	Variable, 20–60 bytes, with options	Fixed 40-byte base header + extension headers
Header checksum	Yes (recomputed at every hop)	None
Fragmentation	By sender and routers	Only by the source host (Path MTU Discovery)
Configuration	Manual or DHCP	SLAAC, DHCPv6 or manual
Broadcast	Yes	No – multicast and anycast instead
IP → MAC resolution	ARP	Neighbor Discovery Protocol (ICMPv6)
IPsec	Optional add-on	Built into the design (AH/ESP extension headers); support SHOULD be provided by all nodes (RFC 8504)
NAT	Widely needed	Not needed for address saving
Hop counter	TTL	Hop Limit
DNS record / loopback	A / 127.0.0.1	AAAA / ::1

Part 2: How IPv6 is more secure

1. IPsec designed in: authentication (AH) and encryption (ESP) are native extension headers, and every IPv6 node is expected to support IPsec. (IPv4 can use IPsec too, but as an add-on.)
2. End-to-end connectivity without NAT: each device has a global address, so end-to-end IPsec and encryption work without NAT breaking them.
3. Scanning is impractical: one /64 subnet holds 2⁶⁴ ≈ 1.8 × 10¹⁹ addresses. Probing 1 million addresses per second would take 2⁶⁴ ÷ 10⁶ ÷ (3.16 × 10⁷ s/year) ≈ 585,000 years, so worms that scan for random hosts become far less effective.
4. No broadcast: broadcast-amplification attacks such as the Smurf attack are not possible.
5. No ARP: ARP spoofing disappears; Neighbor Discovery can be protected with SEND (Secure Neighbor Discovery, RFC 3971) using cryptographically generated addresses, and switches can use RA Guard.
6. Privacy addresses: temporary, random interface IDs (RFC 8981, which replaced RFC 4941) make it harder to track a device across networks.
7. Safer fragmentation: routers never fragment, and overlapping fragments must be discarded (RFC 5722), closing some evasion tricks.

Balanced view (earns marks): IPv6 is not secure automatically. IPsec must still be configured, and IPv6 brings its own risks – rogue Router Advertisements, NDP spoofing without SEND/RA Guard, abuse of extension headers, and IPv6 tunnels or dual-stack hosts that bypass IPv4-only firewalls and IDS. A secure deployment needs IPv6-aware firewalls, IDS rules and monitoring.

graph LR
    A["Host A: 2001:db8:1::10"] -->|"ESP: encrypted + authenticated, no NAT"| B["Host B: 2001:db8:2::20"]
    S["Scanner"] -.->|"2^64 addresses per /64 subnet"| N["Subnet 2001:db8:1::/64"]

Exam tip: lead with 32 vs 128 bits, then header differences, and for security give IPsec built in, no NAT (end-to-end), huge address space against scanning, no broadcast/ARP – and add that IPv6 still needs proper configuration.