Data Diode ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A city's traffic control system needs to share intersection status with a public data portal. The portal is on the internet and is considered untrusted. The traffic control network must remain isolated. What is the best way to share the status data?

   • AUse a data diode to send status data to a web server in a DMZ, and the public portal pulls data from that web server.
   • BUse a firewall to allow outbound traffic from the traffic control network to the portal.
   • CSend the status data to the portal via email on a daily basis.
   • DAllow the public portal to connect directly to the traffic control network to fetch data.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A water utility needs to send real-time sensor readings from a legacy PLC network to a corporate historian for analysis. The security team is concerned about malware spreading from the corporate network back into the OT environment. They want a solution that physically prevents any return traffic while still allowing the sensor data to flow. What should they deploy?

   • AA network tap that copies traffic from the PLC network to the corporate network
   • BA firewall rule that blocks all inbound traffic from the corporate network to the PLC subnet
   • CA VPN tunnel from the PLC network to the corporate network with strong encryption
   • DA data diode installed between the PLC network and the corporate network, with the transmit side on the PLC network
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What mechanism does a data diode use to prevent reverse communication?

   • AIt uses a protocol that does not support acknowledgments
   • BIt uses a firewall rule that drops all inbound packets
   • CIt uses encryption to make reverse traffic unreadable
   • DIt uses a physical design that eliminates the return path for signals
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A power utility is using a data diode to send synchrophasor data from substations to a control center. The control center needs to send a small amount of configuration data back to the substation devices. What is the best approach?

   • AUse a firewall instead of a data diode to allow bidirectional traffic
   • BSend the configuration data as a file through the existing data diode, but in the reverse direction
   • CDeploy a second data diode in the reverse direction, with strict access controls on the send side
   • DUse the same data diode for both directions by swapping the fiber connections
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security auditor is reviewing the architecture of a nuclear facility. The facility uses a data diode to send safety system logs to an external monitoring service. The auditor asks: 'What security benefit does this provide beyond a firewall?' What is the best answer?

   • AIt allows the external service to send acknowledgments back to the safety system
   • BIt prevents any malware from the external network from reaching the safety system, even if the firewall is misconfigured
   • CIt reduces the amount of log data that needs to be transmitted
   • DIt encrypts the logs so that they cannot be read by the external service
   Reveal Solution Discussion Select an answer first