Explain How Industry Standard Security Frameworks (PCI, HIPAA, OT/IC, Others) Affect Cyber Defense Architecture. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A water treatment facility is implementing a security monitoring solution for its OT network. The architect must balance the need for visibility with the operational constraints of the ICS environment. Which approach is most appropriate?

   • ADeploy passive network monitoring sensors on the OT network to collect traffic data without impacting operations.
   • BInstall active security agents on all PLCs and RTUs to collect host-based logs.
   • CConnect the OT network directly to the corporate SIEM without segmentation.
   • DRoute all OT traffic through a next-generation firewall for deep packet inspection.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A retail company processes credit card payments in its primary data center and is designing a new cardholder data environment (CDE). The security architect must ensure that the network architecture supports PCI DSS compliance. Which architectural control is most directly required by PCI DSS for the CDE?

   • AImplement network segmentation to isolate the CDE from untrusted networks.
   • BConfigure intrusion detection on the management network.
   • CDeploy a next-generation firewall at the internet edge to filter inbound traffic.
   • DEnable full disk encryption on all servers in the data center.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is implementing access controls to meet PCI DSS. Which control is most directly required by PCI DSS for access to the cardholder data environment?

   • AAssign a unique ID to each person with access to the CDE.
   • BRequire multi-factor authentication for all users.
   • CUse role-based access control for all users.
   • DImplement single sign-on for all applications.
   Reveal Solution Discussion Select an answer first
5. 24foundation · medium

   Which PCI DSS requirement directly mandates that cardholder data be rendered unreadable when stored, and how does this typically influence a security architect's choice of storage controls?

   • ARequirement 4: Encrypt transmission of cardholder data across open networks, focusing on network encryption.
   • BRequirement 3: Protect stored cardholder data, leading to encryption or tokenization of stored PANs.
   • CRequirement 8: Identify and authenticate access to system components, focusing on access control.
   • DRequirement 10: Track and monitor all access to cardholder data, focusing on logging.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A power utility is updating its OT network security architecture. The architect must follow IEC 62443 while also ensuring that safety systems remain operational. Which architectural control is most consistent with IEC 62443's zone and conduit model?

   • AImplement a flat network to minimize latency and ensure safety system responsiveness.
   • BDeploy a next-generation firewall between every device on the network.
   • CUse a single security appliance to monitor all OT traffic.
   • DDivide the OT network into zones based on risk and connect them through conduits with controlled access.
   Reveal Solution Discussion Select an answer first