Next Generation Firewalls ICSSCADA Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   How does an NGFW typically identify an application when the application uses non-standard ports or protocols?

   • ABy querying the application's vendor for a list of IP addresses
   • BBy blocking all traffic that uses non-standard ports
   • CBy relying solely on the destination port number
   • DBy analyzing the application's signature, behavior, or performing SSL/TLS inspection
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How does an IPS differ from an Intrusion Detection System (IDS)?

   • AAn IPS is a software-only solution, while an IDS is hardware-based
   • BAn IPS only detects known threats, while an IDS detects unknown threats
   • CAn IPS is used only for wireless networks, while an IDS is for wired networks
   • DAn IPS can actively block threats, while an IDS typically only alerts
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A chemical plant's NGFW has accumulated hundreds of rules over several years. The security team notices that some rules are redundant and others are rarely used. They want to optimize the rule set without accidentally blocking critical control traffic. What should they do first?

   • AEnable IPS on all rules to increase security.
   • BMove the NGFW to passive mode to test rule changes.
   • CDelete all rules that have not been modified in the last year.
   • DAnalyze firewall logs to identify which rules are actually being hit and which are redundant.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a best practice for managing NGFW rule sets in an ICS/SCADA environment?

   • ARegularly review and remove unused or overly permissive rules
   • BDisable logging to improve performance
   • CUse the same rule set for all network segments
   • DAdd as many rules as possible to cover all scenarios
   Reveal Solution Discussion Select an answer first