Identify Strategies to Monitor an Environment That Requires Nonstandard or Out-Of-Band Instrumentation and Sensors, E.g. Legacy Data Sources, OT/IC Infrastructure Environments. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A chemical plant has a process control network that uses a mix of Ethernet and serial devices. The security team needs to monitor both types of traffic for anomalies. They have a limited budget and cannot disrupt operations. What is the most cost-effective and least intrusive approach?

   • ADeploy a full packet capture appliance on every segment and link.
   • BEnable logging on all switches and routers and send the logs to Splunk.
   • CInstall a network intrusion detection system (NIDS) inline at the network perimeter.
   • DUse a combination of passive TAPs on Ethernet segments and serial line splitters on serial links, feeding a single collector.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of out-of-band instrumentation for data collection?

   • ATo replace the primary network and provide higher bandwidth for data transfer
   • BTo collect data from sources that cannot send data through standard in-band channels
   • CTo provide a backup path for network traffic in case of failure
   • DTo encrypt all data in transit to meet compliance requirements
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A transportation company has a legacy fare-collection system that uses a proprietary protocol over a serial connection. The system is critical and cannot be taken offline. The security team needs to monitor the serial traffic for signs of tampering. What is the best approach?

   • AReplace the serial connection with an Ethernet connection and use a network TAP.
   • BUse a serial line splitter to passively copy the traffic to a protocol-aware collector.
   • CInstall a software agent on the fare-collection system to forward logs.
   • DConnect a laptop to the serial port to capture traffic manually when needed.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which strategy is appropriate for monitoring a nonstandard environment while maintaining operational integrity?

   • ADeploying active agents on all OT devices to collect logs
   • BConnecting the OT network directly to the internet for easier data collection
   • CReplacing all legacy devices with modern ones that support standard logging
   • DUsing passive monitoring techniques that do not interfere with the OT network
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A power utility has a legacy SCADA system that uses a proprietary protocol over serial connections. The security team wants to integrate this data into their Splunk environment for monitoring. The serial connections are isolated from the IP network. What is the best way to collect this data?

   • APlace a network TAP on the serial cable and connect it directly to a Splunk indexer.
   • BInstall a Splunk Universal Forwarder on the SCADA server to collect the serial data directly.
   • CUse a serial-to-Ethernet converter that sends the serial data to a collector, which then forwards it to Splunk.
   • DManually export logs from the SCADA system and upload them to Splunk periodically.
   Reveal Solution Discussion Select an answer first