Data Diode ICSSCADA Practice Questions (Page 8)

Questions 36–37

1. 36application · medium

   A water utility needs to send real-time flow and pressure readings from its SCADA historian to a corporate analytics platform that also hosts email and internet-facing web services. The security team insists that no traffic can ever originate from the corporate network toward the OT network. Which solution should the team select?

   • APlace a read-only replica of the historian database on the corporate network and synchronize it using a scheduled job.
   • BConfigure a VPN tunnel from the corporate network to the SCADA historian so that analytics can pull data securely.
   • CInstall a stateful firewall with a rule allowing outbound traffic from the historian to the corporate network and blocking all inbound traffic.
   • DDeploy a data diode between the SCADA historian and the corporate network, with the diode's transmit side connected to the historian and the receive side to the corporate network.
   Reveal Solution Discussion Select an answer first
2. 37application · easy

   A nuclear facility is required to share safety system status with a regulatory agency's monitoring system. The agency's system is on a separate network that is considered less secure. The facility must ensure that no data can be sent from the agency's network to the facility. Which technology should be deployed?

   • AA router with an access control list that permits only specific IP addresses.
   • BA data diode with the transmit side on the facility network and the receive side on the agency network.
   • CA VPN tunnel that encrypts all traffic between the two networks.
   • DA firewall with a rule that blocks all inbound traffic from the agency network.
   Reveal Solution Discussion Select an answer first