Identify Strategies to Monitor an Environment That Requires Nonstandard or Out-Of-Band Instrumentation and Sensors, E.g. Legacy Data Sources, OT/IC Infrastructure Environments. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which method is an example of out-of-band instrumentation for collecting data from a legacy system?

   • AConfiguring the legacy system to send SNMP traps to a monitoring server
   • BUsing a network tap to passively capture traffic from the legacy system's serial port
   • CInstalling a syslog agent on the legacy system
   • DEnabling Windows Event Log forwarding on the legacy system
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which sensor placement provides the best visibility for monitoring a legacy serial-based device?

   • AA sensor on the corporate firewall logging all inbound traffic
   • BA network tap on the Ethernet connection to the device
   • CA sensor attached to the serial console port of the device
   • DA sensor on the device's power line to detect activity
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A food and beverage company has a legacy bottling line that uses a proprietary protocol over a serial connection. The line is controlled by a PLC that does not have any logging capabilities. The security team needs to monitor the line for anomalies. What is the best way to gain visibility?

   • AEnable logging on the PLC if it has a built-in web server.
   • BUse a serial line splitter to passively copy the serial traffic to a protocol-aware collector.
   • CInstall a network TAP on the Ethernet connection of the PLC.
   • DReplace the PLC with a newer model that supports standard logging.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which challenge is commonly encountered when collecting data from OT/IC environments?

   • AOT devices generate too much data for any monitoring system to handle
   • BLack of encryption on all OT data, making it unreadable
   • CProtocol incompatibility between OT devices and standard monitoring tools
   • DExcessive data volume from standard logging protocols
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A pharmaceutical company has a validated manufacturing execution system (MES) that runs on a legacy operating system. The system is subject to regulatory requirements and cannot be modified. The security team needs to monitor the system for anomalies. What is the best strategy?

   • AInstall a security agent on the MES server to collect host-based logs.
   • BDeploy a passive network TAP on the MES network segment and analyze the traffic with an IDS.
   • CPlace a firewall between the MES and the rest of the network and enable logging.
   • DConfigure the MES to send syslog to a central log server.
   Reveal Solution Discussion Select an answer first