Electronic Security Perimeter(s) GCIP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A refinery's ESP includes a data historian that must receive data from a remote sensor network via a gateway. The gateway is located outside the ESP and communicates over a wireless link. What is the best way to integrate the gateway into the ESP architecture?

   • AUse a VPN tunnel from the gateway to the historian and allow all traffic through the tunnel.
   • BPlace the gateway inside the ESP and allow it to communicate directly with the historian without restrictions.
   • CConnect the gateway directly to the historian's network port and bypass the firewall.
   • DTreat the gateway as an intermediate system and place it in a DMZ with firewall rules that allow only the required data flow to the historian.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In an access rule on a firewall protecting an Electronic Security Perimeter (ESP), what does the 'deny' action do?

   • ALogs the traffic but allows it to pass
   • BRedirects the traffic to a proxy for inspection
   • CAllows the traffic only if it is encrypted
   • DBlocks the traffic that matches the rule from crossing the ESP
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A water utility's control network connects to a business network through a firewall. The control network uses RFC 1918 addressing and has no direct internet route. The business network has internet access. An engineer needs to allow a vendor to remotely view historian data from the control network via a secure web portal hosted on the business network. What is the most appropriate way to enable this while maintaining the ESP?

   • ACreate a VPN tunnel from the vendor's office directly to the control network's switch, bypassing the firewall.
   • BPlace the historian server on the business network and allow the vendor to access it directly over the internet.
   • CAdd a static NAT rule on the firewall to map the historian server's private IP to a public IP, allowing the vendor to connect directly from the internet.
   • DConfigure the firewall to allow outbound HTTPS from the control network to the business network's web portal, and require the vendor to access the portal from the business network.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A remote substation has a legacy dial-up modem connected to a programmable logic controller (PLC) for emergency maintenance. The modem is currently configured with no authentication. The security manager requires that any dial-up access be secured and monitored. Which combination of controls is most appropriate?

   • AKeep the modem on but rely on the phone number being unlisted.
   • BDisconnect the modem and use a cellular router with a public IP for remote access.
   • CEnable callback to a pre-approved number, require multi-factor authentication, and log all sessions.
   • DAdd a simple password to the modem and enable call waiting.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A natural gas pipeline company has an ESP that separates the control network from a business network. The control network needs to send operational data to a cloud-based analytics service. The security policy requires that no inbound connections are allowed from the internet to the control network. The analytics service only supports inbound connections (e.g., it cannot initiate outbound). What is the most appropriate solution?

   • AConfigure the firewall to allow the cloud service to connect directly to the control network's database.
   • BPlace the control network's data server on the business network with a public IP.
   • CUse a VPN tunnel from the control network to the cloud service, allowing the cloud service to initiate the connection.
   • DUse a message broker in a DMZ that the control network pushes data to, and the cloud service pulls from the broker.
   Reveal Solution Discussion Select an answer first