3.2 Architect Infrastructure and System Security ISSAP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A manufacturing plant has a legacy OT network with programmable logic controllers (PLCs) that use unencrypted protocols. The plant's IT team wants to deploy a new monitoring solution that requires network access to the PLCs. The security architect must balance the need for monitoring with the risk of exposing the OT network. The PLCs cannot be patched or upgraded. Which approach is most appropriate?

   • AUse a VPN concentrator on the OT network and have the monitoring solution connect through the VPN.
   • BInstall a firewall between the IT and OT networks and allow the monitoring solution to connect to the PLCs on the required ports.
   • CPlace the monitoring solution on the OT network and have it send alerts to the IT network via a one-way data diode.
   • DDeploy a network tap (passive) on the OT network to send a copy of the traffic to the monitoring solution, without allowing any return traffic.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A database administrator needs to provide a development team with a copy of a production database that contains personally identifiable information (PII). The security architect must ensure that the development team cannot see the actual PII values, but the data structure and relationships must remain intact for testing. Which technique should be used?

   • AApply data masking to the PII fields in the copy, replacing real values with realistic but fictitious data.
   • BEncrypt the PII fields in the copy and provide the decryption key to the development team.
   • CRedact the PII fields by replacing them with a fixed string like 'XXX'.
   • DRemove the PII columns entirely from the copy.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a key security consideration when allowing employees to connect personal devices (BYOD) to the corporate network?

   • AThe device cannot connect to the internet
   • BThe device is automatically more secure than corporate devices
   • CThe device does not require authentication
   • DThe device may not have the same security controls as corporate-managed devices
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A financial institution is implementing a data loss prevention (DLP) program. The security architect must prevent sensitive customer data from being sent via email, but also needs to allow legitimate business communications with customers. The DLP solution must be able to distinguish between a customer sending their own data to the institution and an employee sending customer data to an external party. Which DLP strategy is most effective?

   • AConfigure the DLP policy to monitor outbound email and use contextual analysis to identify the sender and recipient, blocking or flagging emails from employees to external addresses that contain sensitive data patterns.
   • BOnly monitor emails sent from the executive team and ignore emails from other employees.
   • CEncrypt all outbound emails that contain sensitive data and require the recipient to authenticate.
   • DBlock all emails that contain sensitive data patterns, regardless of the sender or recipient.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary security purpose of an airgap in a network architecture?

   • ATo physically isolate a network from all other networks
   • BTo filter traffic based on application-layer rules
   • CTo detect and block malware using signature-based scanning
   • DTo encrypt all traffic between network segments
   Reveal Solution Discussion Select an answer first