Electronic Security Perimeter(s) GCIP Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An ESP firewall logs show a series of failed inbound connection attempts to a control system server from various external IP addresses. The attempts are on port 502 (Modbus TCP). The server is not supposed to be accessible from the internet. What is the most appropriate response?

   • AChange the server's IP address to avoid the scans.
   • BDisable the server's Modbus service.
   • CVerify that the firewall blocks inbound port 502 and consider adding an intrusion prevention rule to drop such traffic.
   • DIgnore the attempts because they are failing.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which control is essential for securing a dial-up connection into an Electronic Security Perimeter (ESP)?

   • AConnecting the modem directly to a workstation inside the ESP
   • BDisabling logging on the modem to reduce overhead
   • CStrong authentication, such as a callback or multi-factor authentication
   • DUsing a high-speed modem to reduce connection time
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An ESP firewall logs show a large amount of outbound traffic from a control system server to an external IP on port 53 (DNS). The traffic is occurring at regular intervals. The server is not supposed to perform DNS lookups. The security team suspects the server may be compromised. What is the most appropriate immediate action?

   • AIgnore the traffic because DNS is a common protocol.
   • BIsolate the server from the network and perform a forensic analysis of its processes and logs.
   • CReboot the server to clear the suspicious processes.
   • DBlock the external IP address at the firewall and continue monitoring.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A power utility allows remote operators to access the ESP via a VPN. The operators use personal laptops that are not managed by the utility. The security team wants to enforce multi-factor authentication and session recording. However, the operators' personal laptops cannot install any software. What is the best way to achieve the security goals?

   • AAllow operators to use personal laptops but require them to install a lightweight agent.
   • BProvide a managed laptop to each operator that has the required security software pre-installed.
   • CDisable remote access and require operators to be on-site.
   • DRequire operators to use their personal laptops with browser-based MFA and record sessions on the VPN gateway.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A water treatment plant's ESP has a firewall that allows outbound SNMP traps from the control network to a monitoring server in the business network. The monitoring server also needs to send SNMP polls to the control network devices. What is the appropriate access rule configuration?

   • AAllow inbound SNMP polls from the monitoring server to the control network devices on the SNMP port, and allow outbound traps back.
   • BAllow only outbound traps and require the monitoring server to use a different protocol for polling.
   • CAllow all inbound traffic from the business network to the control network to simplify management.
   • DPlace the monitoring server inside the ESP to avoid firewall rules.
   Reveal Solution Discussion Select an answer first