Identify Strategies to Monitor an Environment That Requires Nonstandard or Out-Of-Band Instrumentation and Sensors, E.g. Legacy Data Sources, OT/IC Infrastructure Environments. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of a legacy data source that would require out-of-band monitoring?

   • AA mainframe system that only outputs data via serial console or tape
   • BA modern cloud-native application logging to a SIEM via API
   • CA network switch exporting NetFlow to a collector
   • DA Linux server sending syslog over UDP to a central collector
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which environment is most likely to contain nonstandard data sources that require out-of-band monitoring?

   • AA public cloud environment with virtual machines and containers
   • BAn operational technology (OT) network controlling industrial machinery
   • CA software-as-a-service (SaaS) application environment
   • DA standard enterprise network with Windows and Linux servers
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A water treatment facility uses an OT network with a mix of modern Ethernet-based sensors and older serial-based controllers. The security team wants to monitor both types without affecting the control loops. What is the most effective approach?

   • AConnect the OT network to the corporate network and use existing network monitoring tools.
   • BInstall a next-generation firewall at the OT network perimeter and enable logging for all traffic.
   • CDeploy passive network TAPs on the Ethernet segments and serial line splitters on the serial links, feeding a protocol-aware collector.
   • DUse a single universal agent that can be installed on every device to collect logs and metrics.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A manufacturing plant has a legacy programmable logic controller (PLC) that communicates using a proprietary serial protocol. The plant network is air-gapped from the corporate network. The security team needs visibility into the PLC's traffic without disrupting production. What should they do?

   • AInstall a network TAP on the serial link and forward a copy of the traffic to a collector that can parse the proprietary protocol.
   • BConfigure the PLC's built-in logging to send syslog messages to the Splunk indexer over the corporate network.
   • CInstall a software agent on the PLC to forward its internal state to the Splunk forwarder.
   • DReplace the PLC with a modern model that supports standard TCP/IP monitoring.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A utility company has a distribution automation system that uses a mix of IP and serial communication. The security team wants to monitor the system for cyber threats without affecting the reliability of the power grid. What is the best approach?

   • ADeploy agents on all OT devices to collect host-based logs.
   • BUse a firewall with deep packet inspection at the boundary of the OT network.
   • CDeploy passive TAPs on IP segments and serial splitters on serial links, feeding an IDS that is tuned to the OT protocols.
   • DInstall an inline IPS that can block malicious traffic in real time.
   Reveal Solution Discussion Select an answer first