Next Generation Firewalls ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A pharmaceutical company's NGFW is configured with IPS and SSL/TLS decryption. The security team notices that some legitimate encrypted traffic is being blocked by the IPS. They want to reduce false positives while maintaining threat detection. What should they do?

   • ADisable SSL/TLS decryption to avoid false positives.
   • BIncrease the IPS sensitivity to catch more threats.
   • CCreate exceptions for specific applications or destinations that are known to be safe, and tune the IPS signatures.
   • DSet the IPS to alert-only mode for all signatures.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A transportation authority's NGFW logs show repeated failed login attempts from an external IP to the remote access VPN. The security team wants to detect and respond to this anomaly. What should they configure on the NGFW?

   • ABlock all traffic from the external IP immediately.
   • BEnable SSL/TLS decryption on the VPN traffic.
   • CDisable logging for the VPN to reduce noise.
   • DSet up an alert for multiple failed authentication attempts and integrate with the SIEM for correlation.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary role of an NGFW in an air-gapped ICS/SCADA environment?

   • ATo provide a controlled and secure path for necessary data exchange
   • BTo physically disconnect the ICS network from all external networks
   • CTo encrypt all data at rest in the ICS database
   • DTo replace the need for any other security controls
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A water utility has an NGFW deployed in passive mode on its SCADA network. The SOC has noticed that the NGFW is generating a high volume of alerts, many of which are false positives. They want to reduce the noise while still detecting real threats. They have limited staffing and cannot manually review every alert. What is the best strategy?

   • AIncrease the alert threshold to only alert on critical severity events.
   • BTune the IPS signatures to reduce false positives, and create alert rules for specific high-risk behaviors, such as unexpected outbound connections.
   • CSet the NGFW to send all alerts to a SIEM and let the SIEM correlate them.
   • DDisable all IPS signatures and rely on log review to detect threats.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In which deployment mode does an NGFW sit directly in the traffic path and can block or allow traffic as it passes?

   • APassive mode
   • BTap mode
   • CVirtual mode
   • DInline mode
   Reveal Solution Discussion Select an answer first