Electronic Security Perimeter(s) GCIP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A control system engineer needs to perform maintenance on a PLC from a remote location. The remote access solution must support interactive sessions and be secured with multi-factor authentication. Which solution is most appropriate?

   • AA VPN with certificate and OTP authentication, followed by an RDP session to a jump server.
   • BA direct modem connection with a username and password.
   • CA web-based remote access tool with single sign-on.
   • DAn email request to a technician on site to make changes.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Where should access rules be placed to effectively control traffic entering and leaving an Electronic Security Perimeter (ESP)?

   • AOn every workstation inside the ESP
   • BOn the core switch inside the ESP
   • COn the corporate DNS server
   • DOn the electronic access point(s) that connect the ESP to external networks
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is interactive remote access in the context of an Electronic Security Perimeter (ESP)?

   • AA user establishing a real-time session with a system inside the ESP from an external location
   • BA batch file that runs on a server without user intervention
   • CA one-way communication from a sensor to a monitoring station
   • DAutomated data transfer between two systems using a scheduled job
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A regional electric cooperative is updating its ESP architecture. The control network includes a mix of modern and legacy devices. The security team must balance the need for remote monitoring by the NERC CIP compliance team with the requirement to keep the ESP clearly defined. The compliance team needs read-only access to logs and alarms from the control network. The legacy devices cannot support modern authentication. What is the best approach?

   • AImplement a read-only data diode from the control network to a log aggregation server in a DMZ, and allow the compliance team to access the aggregation server via a jump host with MFA.
   • BUse a firewall rule to allow the compliance team's IP addresses to access the control network's log server directly.
   • CAllow the compliance team to connect directly to the legacy devices using a shared password.
   • DPlace the legacy devices outside the ESP so they can be accessed directly by the compliance team.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A cybersecurity analyst at a wastewater facility notices that a PLC inside the ESP is sending large amounts of data to an external IP address that is not on any approved list. The traffic is encrypted. What is the best next step to determine if this is malicious communication?

   • ADisconnect the PLC from the network and replace it.
   • BIgnore the traffic because it is encrypted and cannot be inspected.
   • CReview the PLC's configuration and logs to see if any rule or service is generating the traffic.
   • DBlock the external IP address at the firewall immediately.
   Reveal Solution Discussion Select an answer first