Hardening & Protecting Endpoints GICSP Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An OT security analyst notices unusual outbound connections from a PLC programming workstation to an external IP address. The workstation runs a host-based firewall and antivirus. What is the first step to investigate this potential incident?

   • AImmediately reimage the workstation to remove any malware.
   • BBlock the external IP address in the firewall and continue monitoring.
   • CDisable the host-based firewall to allow full network visibility.
   • DCheck the endpoint's security logs for process execution and network connection events.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A food processing plant has a historian server that collects data from PLCs. The server is not patched because the vendor has not validated any updates. The security team wants to detect if the server is being used as a pivot point. Which monitoring approach is most effective for this purpose?

   • AConfigure the server to send syslog to a log file on the same server for later review.
   • BInstall a host-based intrusion prevention system (HIPS) with default signatures and no custom rules.
   • CEnable SNMP traps on the network switch and monitor interface traffic counters.
   • DEnable Windows Event Logging for logon events and process creation, and forward those logs to a central SIEM for correlation.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A chemical plant has a mix of Windows and Linux endpoints. The security team wants to implement a consistent hardening standard. What is the first step in developing a secure configuration baseline?

   • AIdentify the security requirements and operational constraints for each endpoint role.
   • BPurchase a commercial hardening tool that supports both operating systems.
   • CDisable all unnecessary services and ports on every endpoint.
   • DApply the CIS benchmark for Windows and Linux to all endpoints.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary purpose of endpoint monitoring and logging?

   • ATo increase the performance of the endpoint by reducing resource usage
   • BTo automatically patch vulnerabilities without human intervention
   • CTo detect suspicious activity and provide evidence for incident response and forensic analysis
   • DTo replace the need for antivirus software
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A water utility has a mix of Windows 10 and Windows 7 SCADA HMIs. The vendor has stopped supporting Windows 7, but the HMIs cannot be upgraded until the next scheduled outage. What is the most appropriate immediate action to reduce risk?

   • AImplement compensating controls such as network segmentation and application whitelisting on the Windows 7 HMIs.
   • BDisconnect the HMIs from the network and operate them in manual mode.
   • CUpgrade the HMIs to Windows 10 immediately despite the outage risk.
   • DApply all available patches to Windows 7 from the vendor's legacy archive.
   Reveal Solution Discussion Select an answer first