Next Generation Firewalls ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A large manufacturing company has an NGFW with a complex rule set that includes many rules for legacy protocols. The security team wants to optimize the rule set to improve performance, but they must ensure that no critical ICS traffic is disrupted. They have access to the NGFW's logs and a network analyzer. What is the best approach?

   • AUse the network analyzer to capture traffic and compare it to the rule set to identify rules that are never matched.
   • BManually review the rule set and remove any rules that seem unnecessary based on the security team's knowledge.
   • CPerform a rule-set analysis using the NGFW's built-in tools to identify shadowed, redundant, and unused rules, and then test changes in a lab before applying.
   • DAnalyze the NGFW logs to identify rules that have not been hit in the last 90 days, and remove or disable them.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A food processing company's NGFW is currently configured to allow all outbound traffic from the corporate network. The security team wants to restrict access to only business-required applications, such as email and web browsing, while blocking peer-to-peer file sharing. What should they configure?

   • ABlock all traffic on common peer-to-peer ports.
   • BCreate an allowlist policy that permits specific application signatures for email and web browsing, and blocks all other applications.
   • CEnable SSL/TLS decryption to inspect all outbound traffic.
   • DSet the firewall to passive mode to monitor application usage.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary role of an Intrusion Prevention System (IPS) integrated into an NGFW?

   • ATo provide a backup of firewall configurations
   • BTo log all network traffic for forensic analysis
   • CTo detect and block known and unknown threats in real time
   • DTo encrypt traffic between two sites
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A hospital's NGFW is deployed inline between the IT network and the medical device network. The security team wants to enable IPS to detect and block known malware, but they are concerned about false positives disrupting critical medical devices. The NGFW logs show that some medical devices use proprietary protocols that are not well-documented. The hospital has a 24/7 operations requirement. What is the best approach to deploy IPS safely?

   • AEnable IPS in alert mode for the medical device network, and create exceptions for the proprietary protocols after monitoring.
   • BDisable IPS and rely on the stateful firewall to block known malware.
   • CEnable IPS in block mode for all traffic to maximize security.
   • DDeploy the NGFW in passive mode to monitor traffic without IPS.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which set of capabilities is most characteristic of a next-generation firewall (NGFW) compared to a traditional stateful firewall?

   • AAntivirus scanning, email filtering, and web proxy caching
   • BStateful inspection, application awareness, and integrated intrusion prevention
   • CPort-based ACLs, MAC filtering, and DHCP services
   • DPacket filtering, NAT, and VPN termination
   Reveal Solution Discussion Select an answer first