Next Generation Firewalls ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A government agency has an air-gapped network for classified data. They need to receive software updates from a vendor, but the security policy prohibits any direct connection. The agency has an NGFW with application identification and IPS. They are considering using the NGFW to create a controlled bridge for the updates. What is the most secure approach?

   • AUse a manual transfer process with a removable media, and use the NGFW to scan the media for malware before it enters the air-gapped network.
   • BConfigure the NGFW to allow a one-time connection from the vendor to the air-gapped network for the update.
   • CUse the NGFW's VPN feature to securely transfer the update over the internet.
   • DDeploy the NGFW in inline mode between the vendor and the air-gapped network to filter the update traffic.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A large energy company has an NGFW with over 2,000 rules protecting its ICS network. The security team wants to optimize the rule set to improve performance and reduce complexity. They have identified that many rules are redundant, but they are concerned about breaking critical control traffic. The NGFW logs show that 80% of traffic is allowed by the first 100 rules. The team has limited maintenance windows. What should they do?

   • AMove the NGFW to passive mode to test rule changes without affecting traffic.
   • BDelete all rules after the first 100 because they are rarely used.
   • CAnalyze the logs to identify redundant rules and consolidate them, testing changes in a lab environment first.
   • DEnable IPS on all rules to improve security and reduce the need for rule optimization.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key compliance consideration when implementing SSL/TLS decryption?

   • AEnsuring that decryption uses the strongest encryption algorithm
   • BEnsuring that decryption is performed by a third-party vendor
   • CEnsuring that decryption is performed only on weekends
   • DEnsuring that decryption complies with data privacy regulations and organizational policies
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A water utility's ICS network uses a legacy SCADA protocol that runs over TCP port 502. The security team recently discovered that an employee's laptop on the corporate network was able to reach a PLC by using the same port 502, even though the corporate firewall was configured to block that port. The NGFW is deployed at the boundary between corporate and ICS networks. What should the security administrator configure to prevent this while maintaining legitimate SCADA traffic?

   • AEnable application identification and create a policy that allows only the SCADA application signature, not raw TCP port 502.
   • BConfigure SSL/TLS decryption on the corporate firewall to inspect the payload of port 502 traffic.
   • CBlock TCP port 502 on the corporate firewall and require all SCADA traffic to use a different port.
   • DDisable stateful inspection on the NGFW to allow only established SCADA sessions.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A wastewater treatment plant has an NGFW with a rule set that has grown to over 500 rules over several years. The security team notices that the firewall's CPU usage is consistently high, and they suspect rule mismatches are causing unnecessary processing. They want to optimize the rule set without reducing security. What should they do first?

   • ADisable the IPS feature to reduce CPU usage.
   • BEnable logging on all rules to identify which rules are being hit.
   • CIncrease the firewall's CPU resources by upgrading the hardware.
   • DReview the rule set to identify and remove unused or shadowed rules, and consolidate similar rules.
   Reveal Solution Discussion Select an answer first