Electronic Security Perimeter(s) GCIP Practice Questions (Page 10)

Questions 46–49

1. 46foundation · easy

   Which of the following is a required component of an Electronic Security Perimeter (ESP) as defined in critical infrastructure protection guidance?

   • AA security information and event management (SIEM) system collecting logs from all assets
   • BAn electronic access point that controls all communication crossing the ESP boundary
   • CA demilitarized zone (DMZ) hosting all public-facing services
   • DA virtual private network (VPN) gateway for all remote access
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A natural gas utility has an ESP that includes a historian server. The security team has deployed an IDS that monitors traffic at the ESP boundary. The IDS generates an alert for outbound traffic from the historian to an external IP on port 53 (DNS). The traffic is not typical for the historian. What is the most likely explanation and appropriate response?

   • AThe IDS is malfunctioning; disable the alert.
   • BThe historian is likely performing legitimate DNS resolution; ignore the alert.
   • CThe historian may be compromised and using DNS tunneling to exfiltrate data; investigate the DNS queries and block suspicious domains.
   • DThe historian is sending DNS queries to update its time; this is normal.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A chemical plant's ESP firewall currently has a rule that allows all outbound traffic from the control network to the corporate network. An audit finds that several control system workstations are communicating with unknown external IP addresses. What should be done to reduce risk?

   • AMove the control network to the corporate network segment.
   • BReplace the allow-all rule with a default-deny policy that permits only specific, documented outbound connections.
   • CBlock all outbound traffic from the control network.
   • DKeep the allow-all rule but add an IDS to monitor traffic.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A nuclear facility is defining its ESP. The control network includes several legacy devices that cannot be patched. The security team must ensure that the ESP is clearly defined and that any communication crossing it is controlled. Which approach is most appropriate?

   • ADefine the ESP to exclude the legacy devices and allow them to communicate freely.
   • BPlace all legacy devices inside the ESP and use a firewall to restrict all traffic to only necessary protocols.
   • CMove the legacy devices outside the ESP so they do not affect the protected network.
   • DConnect the legacy devices directly to the internet for remote monitoring.
   Reveal Solution Discussion Select an answer first