Data Diode ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A large hospital network uses a data diode to send patient monitoring data to a research institution. The research institution needs to send a small amount of configuration data back to the monitoring devices. The hospital's security team is concerned about the risk of a reverse channel. What is the most secure way to provide the configuration data?

   • AUse a firewall with a rule that only allows the research institution to send configuration data
   • BUse a VPN tunnel that is only enabled during configuration updates
   • CUse a second data diode in the reverse direction, with the send side on the research institution's network and strict access controls
   • DSend the configuration data as an email attachment through a separate system
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A chemical plant wants to send process data to a vendor for analysis. The vendor's network is considered untrusted. The plant wants to ensure that the vendor cannot send any data back to the plant. They also need to transfer large files (e.g., 500 MB) periodically. What is the most appropriate solution?

   • AUse a serial connection with a null-modem cable
   • BUse a data diode with a file-transfer protocol that supports one-way file delivery
   • CUse a cloud-based file-sharing service and give the vendor read-only access
   • DUse a firewall with a rule that only allows outbound FTP
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In which ICS/SCADA scenario is a data diode most appropriately deployed?

   • ATo provide a backup internet connection for the corporate office
   • BTo securely collect sensor data from a high-security OT network and send it to a lower-security IT network for monitoring
   • CTo allow engineers to remotely configure PLCs from a corporate network
   • DTo enable real-time video conferencing between control room operators and remote experts
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A manufacturing plant wants to send real-time OPC UA data from its OT network to a data analytics platform in the cloud. The OT network is air-gapped and the security policy forbids any inbound connections. The data is time-sensitive and must arrive with minimal latency. What is the most appropriate architecture?

   • APlace a data diode between the OT network and a cloud gateway, and use a one-way protocol like UDP to send OPC UA data
   • BUse a VPN tunnel from the OT network to the cloud and push OPC UA data
   • CUse a data diode but place it in the reverse direction to allow the cloud to pull data
   • DUse a firewall with a rule that only allows outbound OPC UA traffic
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A power generation company must share operational metrics with a third-party weather service for forecasting. The weather service is considered untrusted, and the company wants to ensure that no malware from the weather service can reach the control network. Which approach best meets the requirement?

   • APlace a data diode so that the control network's historian can send data to a staging server, and the weather service can only access the staging server.
   • BUse a firewall with a rule that permits outbound traffic from the historian to the weather service and blocks all inbound traffic.
   • CAllow the weather service to connect directly to the historian via a VPN with strong encryption.
   • DExport the metrics to a USB drive and physically deliver them to the weather service each day.
   Reveal Solution Discussion Select an answer first