Guard ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A utility is upgrading its air-gapped SCADA network. The project manager wants to implement a 'logical air gap' using VLANs and access control lists to reduce costs. What is the primary risk of this approach compared to a physical air gap?

   • AVLANs and ACLs require more physical hardware than a physical air gap.
   • BVLANs and ACLs can be misconfigured, allowing traffic to cross the logical boundary.
   • CVLANs and ACLs do not provide any security benefits.
   • DVLANs and ACLs are slower than a physical air gap.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A chemical plant is designing a new control network. The security architect wants to implement an air gap while allowing remote monitoring by the corporate SOC. Which design best achieves this?

   • AUse a read-only replica of the control system data on the corporate network for SOC monitoring.
   • BConnect the control network to the corporate network through a firewall and allow only SOC IP addresses.
   • CInstall a VPN concentrator on the control network for SOC remote access.
   • DPlace a jump server in a DMZ and allow SOC to RDP into it, then from there access the control network.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A pharmaceutical company's OT network is air-gapped. The security team wants to ensure that only approved USB drives can be used on OT workstations. Which control should be implemented?

   • AConduct weekly audits of USB drive usage.
   • BPost a sign near the workstations reminding employees to only use approved USB drives.
   • CDisable all USB ports on OT workstations.
   • DUse endpoint security software to block all USB devices except those with a specific hardware ID.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A food processing company's OT network is air-gapped. The maintenance team needs to remotely access the OT network from home during off-hours to troubleshoot issues. The security manager wants to enable this without compromising the air gap. What is the most secure approach?

   • ASet up a VPN into the OT network for the maintenance team.
   • BUse a remote access solution that requires a call-back to a pre-authorized phone number.
   • CRequire an on-call technician to be physically present at the facility to perform troubleshooting.
   • DAllow remote access through a jump host that requires multi-factor authentication and is logged.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A utility company is upgrading its substation automation. The new design must isolate the protection relays from the corporate network while allowing engineers to view operational data. Which implementation best meets this requirement?

   • APlace the protection relays on a separate VLAN with a firewall to the corporate network.
   • BAllow engineers to access the relays directly via a modem for remote diagnostics.
   • CConnect the relays to a data diode that sends data to a corporate network server.
   • DUse serial-to-Ethernet converters to connect the relays to a dedicated monitoring server that is not connected to any other network.
   Reveal Solution Discussion Select an answer first