Electronic Security Perimeter(s) GCIP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A pipeline operator's ESP firewall logs show repeated outbound connections from a control-system workstation to an external IP address on port 443 at odd hours. The workstation is not supposed to initiate any outbound traffic. What is the first step to determine if this is malicious communication?

   • ADisconnect the workstation from the network and reimage it.
   • BIgnore the traffic because it is encrypted on port 443 and cannot be inspected.
   • CReview the workstation's process list and network connections to identify the application making the connections.
   • DBlock the external IP address at the firewall immediately.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A water treatment plant has a control network that must receive weather data from an external service. The security policy requires that no direct inbound connections are allowed from the internet to the control network. Which method should be used?

   • AUse a publicly accessible FTP server to stage the weather data.
   • BEmail the weather data to an operator who manually enters it into the control system.
   • COpen a firewall port for the weather service to push data directly to the control network.
   • DHave the control network initiate an outbound connection to the weather service and maintain a persistent session.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An energy company's ESP includes a DMZ with a proxy server that mediates all outbound HTTP/HTTPS traffic from the control network to the internet. A new application in the control network needs to send UDP-based telemetry to an external server. What should the security team do to maintain the ESP's security posture?

   • AConfigure the proxy to support UDP and route the telemetry through it.
   • BBlock the UDP traffic because it cannot be proxied, and require the application to use TCP.
   • CAdd a firewall rule that permits the specific UDP traffic from the application to the external server, and log all such traffic.
   • DPlace the external server inside the ESP to avoid the need for a proxy.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A manufacturing company is defining the ESP for its new control network. The control network has a direct connection to a business network via a firewall, and the business network has internet access. The ESP must include all cyber assets that can affect the reliability of the control system. Where should the ESP boundary be drawn?

   • AAround the control network only, with the firewall as the boundary between control and business networks.
   • BAround the entire business network and control network combined, since they are connected.
   • CAround the internet connection only, since that is the external threat.
   • DAround each individual PLC and RTU, with no network-level boundary.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A pipeline company needs to share real-time sensor data with a government regulator over the internet. The control network is isolated and cannot directly connect to the internet. The data is non-sensitive but must be continuously available. Which intermediate system design is most appropriate?

   • AEmail the data manually each hour.
   • BConfigure a firewall rule to allow the control network to send data directly to the regulator's server.
   • CPlace a one-way data diode between the control network and a DMZ server that the regulator can access.
   • DUse a bidirectional proxy that caches data and allows the regulator to pull it.
   Reveal Solution Discussion Select an answer first