Identify Strategies to Monitor an Environment That Requires Nonstandard or Out-Of-Band Instrumentation and Sensors, E.g. Legacy Data Sources, OT/IC Infrastructure Environments. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   Where should a sensor be placed to monitor traffic on an isolated OT network segment?

   • AAt the boundary between the OT network and the corporate IT network
   • BOn the corporate IT network, outside the OT segment
   • CInside the OT network segment, on a switch port that carries the traffic of interest
   • DOn the management network, separate from both IT and OT
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does network isolation in an OT environment affect data collection?

   • AIt prevents monitoring tools from reaching the OT network, requiring out-of-band methods
   • BIt has no effect on data collection because monitoring tools can be installed on the OT network
   • CIt makes data collection easier because less traffic needs to be monitored
   • DIt allows monitoring tools to collect data through the corporate network without issues
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A power plant has a legacy control system that uses a proprietary protocol over serial connections. The plant also has a modern IP-based monitoring network. The security team wants to integrate the serial data into their Splunk environment for real-time monitoring. The serial connections are isolated from the IP network. What is the best approach?

   • AManually export data from the control system and upload it to Splunk periodically.
   • BPlace a network TAP on the serial cable and connect it directly to a Splunk indexer.
   • CUse a serial-to-Ethernet converter to bridge the serial data to a collector on the IP network, then forward to Splunk.
   • DInstall a Splunk Universal Forwarder on the control system server to collect serial data directly.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A mining company operates a remote site with limited network connectivity. The site has a mix of modern IP-based sensors and legacy serial-based controllers. The security team needs to collect monitoring data from both types without overloading the limited bandwidth. What is the most effective approach?

   • AForward all raw data from both serial and IP sources directly to the central Splunk instance.
   • BDeploy a local collector that ingests data from both serial and IP sources, performs initial analysis, and forwards only relevant events to the central Splunk instance.
   • CStore data locally on a USB drive and physically transport it to the central site periodically.
   • DUse a serial-to-Ethernet converter and forward all data to the central Splunk instance.
   Reveal Solution Discussion Select an answer first