3.1 Identify Infrastructure and System Security Requirements ISSAP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is a primary security objective in an operational technology (OT) environment that often differs from a typical IT environment?

   • AMaximizing data transfer speeds
   • BEnsuring data confidentiality above all else
   • CMaintaining continuous availability and safety of physical processes
   • DEnforcing strict password complexity policies
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of internal zoning in physical security?

   • ATo create layers of access control within a facility
   • BTo provide backup power to critical systems
   • CTo suppress fires in specific areas
   • DTo detect intruders at the perimeter
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A financial services firm is required to monitor all network traffic for anomalies, but it also has strict data privacy requirements that prohibit storing sensitive data in logs. The firm wants to use a SIEM to centralize monitoring. Which approach allows effective monitoring while respecting data privacy?

   • ADisable logging for all traffic to avoid privacy issues
   • BUse network flow data (e.g., NetFlow) instead of full packet capture, and mask sensitive fields in logs
   • CLog all traffic in full detail and rely on access controls to protect the SIEM
   • DCapture full packets but encrypt the logs at rest
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A water treatment facility uses a mix of IT systems for administration and OT systems for controlling pumps and valves. The facility wants to implement monitoring to detect cyber threats, but the OT network has legacy protocols that are not well understood by the IT security team. Which monitoring strategy is most appropriate?

   • ADisable monitoring on the OT network to avoid interference
   • BUse a specialized OT monitoring solution that can parse industrial protocols and establish a baseline of normal behavior
   • CRely on manual log reviews by the IT team
   • DDeploy standard IT intrusion detection systems directly on the OT network
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A regional utility company is modernizing its legacy SCADA system, which controls power distribution. The system must remain operational during the migration, and the company wants to minimize the attack surface exposed to the internet. They plan to use a cloud provider for analytics and reporting, but the SCADA controllers must stay on-premises. Which deployment model and security control combination best meets these requirements?

   • AKeep everything on-premises and avoid cloud analytics entirely
   • BFully migrate the SCADA system to the cloud and rely on the provider's security groups
   • CUse a public cloud model for SCADA controllers and keep analytics on-premises
   • DUse a hybrid model with on-premises SCADA controllers and cloud analytics, connected via a dedicated VPN with strict segmentation
   Reveal Solution Discussion Select an answer first