Electronic Security Perimeter(s) GCIP Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A regional electric utility has a remote operator who accesses the ESP via a VPN from a laptop. The utility wants to implement multi-factor authentication but the operator frequently works in areas with poor cellular coverage and sometimes has no access to a phone. Which MFA method is most appropriate?

   • ASMS-based one-time passcode.
   • BMobile app push notification.
   • CBiometric fingerprint on the laptop.
   • DHardware token that generates a one-time passcode.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An energy company allows engineers to remotely access the control system from home. The remote access solution uses a VPN with certificate-based authentication. The security team wants to add an additional layer of security for interactive sessions. What should be implemented?

   • ARequire a one-time password (OTP) in addition to the VPN certificate.
   • BUse a longer VPN certificate key length.
   • CDisable split tunneling so all traffic goes through the VPN.
   • DImplement a host-based firewall on the engineer's home computer.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Why is multi-factor authentication (MFA) recommended for remote access to an Electronic Security Perimeter (ESP)?

   • AIt provides stronger assurance that the user is authorized by requiring multiple evidence types
   • BIt ensures the connection is encrypted
   • CIt speeds up the login process
   • DIt eliminates the need for session monitoring
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A power generation company needs to allow external vendors to perform maintenance on control system equipment. The vendors require interactive access to engineering workstations inside the ESP. The security team wants to ensure that vendor access is monitored and that vendors cannot access other parts of the control network. What is the most appropriate solution?

   • AGive vendors direct VPN access to the entire control network.
   • BProvide vendors with a jump server in a DMZ that has access only to the specific engineering workstations, and record all sessions.
   • CAllow vendors to use a remote desktop tool that connects directly to the engineering workstations from the internet.
   • DCreate a firewall rule that allows vendor IP addresses to access any control system device.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   In a critical infrastructure environment, what best describes the Electronic Security Perimeter (ESP)?

   • AA single network device that filters all traffic between the corporate network and the internet
   • BA collection of all servers and workstations in the control system network, regardless of connectivity
   • CA logical boundary that encloses all cyber assets that communicate with external systems, with defined entry and exit points
   • DA physical fence and locked gate surrounding the facility that houses the control system
   Reveal Solution Discussion Select an answer first