Electronic Security Perimeter(s) GCIP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An intrusion detection system (IDS) at the ESP boundary flags repeated outbound connections from a control system workstation to an external IP address on port 443 at regular intervals. The workstation is not supposed to have internet access. What is the most appropriate first step?

   • AImmediately block the external IP address at the firewall.
   • BReview the IDS logs and the workstation's process list to determine what application is generating the traffic.
   • CDisconnect the workstation from the network and reimage it.
   • DIgnore the alert because the traffic is encrypted and cannot be inspected.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A natural gas compressor station has a dial-up modem for remote diagnostics. The modem is connected to a serial console server inside the ESP. The security team wants to detect unauthorized dial-up attempts. What is the most effective monitoring control?

   • AImplement an intrusion detection system that monitors the serial console server for unusual activity.
   • BConfigure the modem to disconnect after a short idle timeout and require a callback.
   • CLog all modem connection attempts and review the logs regularly for anomalies.
   • DRequire multi-factor authentication for all dial-up sessions.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of external routable connectivity that crosses an Electronic Security Perimeter (ESP)?

   • AAn operator viewing a local HMI screen directly connected to a PLC via a serial cable
   • BA control system engineer accessing a historian server from the corporate LAN using TCP/IP
   • CA field device sending analog signals over a dedicated 4-20 mA loop to a PLC
   • DA technician using a USB drive to transfer configuration files to a workstation inside the control network
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large utility is redesigning its ESP. The control network has multiple substations connected via a WAN. The security team is considering whether to define a single ESP encompassing all substations or separate ESPs for each substation. The utility has a central NOC that needs to monitor all substations. What is the primary trade-off to consider?

   • AA single ESP simplifies monitoring but increases the attack surface if one substation is compromised.
   • BSeparate ESPs eliminate the need for firewalls between substations.
   • CA single ESP is required by regulation and cannot be changed.
   • DSeparate ESPs are always more secure and should be chosen without considering operational needs.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A pipeline company's ESP has a firewall that allows outbound traffic to the internet. The security team has noticed that a control system workstation is making outbound connections to a known malicious IP address on port 443. The workstation is critical and cannot be taken offline. What is the best immediate action?

   • ABlock the malicious IP address at the firewall and monitor the workstation for further malicious activity.
   • BIgnore the traffic because it is encrypted and cannot be inspected.
   • CChange the workstation's IP address to evade the malicious connection.
   • DDisconnect the workstation from the network immediately.
   Reveal Solution Discussion Select an answer first