Next Generation Firewalls ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is it important to balance security with operational continuity when configuring NGFW policies in critical infrastructure?

   • ANGFWs are not capable of enforcing security without impacting operations
   • BSecurity is not a priority in ICS environments
   • COverly restrictive rules can disrupt legitimate ICS operations
   • DOperational continuity is only a concern for IT networks
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A manufacturing company has an NGFW protecting its OT network. The security team wants to allow remote engineers to access the HMI servers, but only if they are members of the 'ICS-Engineers' group in Active Directory. The engineers use a vendor-specific remote desktop application that runs on a non-standard port. What should the administrator configure on the NGFW?

   • AEnable SSL/TLS decryption and allow all decrypted traffic from the corporate network.
   • BCreate a policy based on source IP addresses of the engineers' workstations.
   • CCreate a policy that allows the remote desktop application for the ICS-Engineers group, using user identity from Active Directory.
   • DAllow the non-standard port for all users from the corporate network.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which NGFW feature is particularly useful for enabling secure remote access into an air-gapped ICS network?

   • AVPN capabilities with strong authentication
   • BMAC address filtering
   • CPort mirroring
   • DNetwork address translation (NAT)
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A chemical plant has a legacy PLC network that cannot tolerate any added latency or potential single point of failure. The security team wants to deploy an NGFW to monitor traffic and detect anomalies without disrupting the existing process control traffic. Which deployment mode is most appropriate?

   • AInline mode with a fail-closed configuration to ensure security if the NGFW fails.
   • BPassive (tap) mode connected to a SPAN port to monitor traffic without being in the data path.
   • CInline mode with a fail-open bypass to ensure traffic continues if the NGFW fails.
   • DVirtual mode deployed as a VM on the same hypervisor as the PLCs.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the purpose of configuring high availability (HA) for an NGFW in an ICS/SCADA environment?

   • ATo simplify the configuration of firewall rules
   • BTo enable remote access for administrators
   • CTo increase the throughput of the firewall
   • DTo ensure uninterrupted security enforcement if the primary device fails
   Reveal Solution Discussion Select an answer first