CAS-002 · Question #140
A security administrator must implement a SCADA style network overlay to ensure secure remote management of all network management and infrastructure devices. Which of the following BEST describes…
The correct answer is D. An isolated network that provides secure out-of-band remote management. A SCADA-style management overlay is best characterized as an isolated network providing out-of-band remote management, keeping management traffic separate from production traffic. This architecture protects critical infrastructure controls from in-band compromise.
Question
A security administrator must implement a SCADA style network overlay to ensure secure remote management of all network management and infrastructure devices. Which of the following BEST describes the rationale behind this architecture?
Options
- AA physically isolated network that allows for secure metric collection.
- BA physically isolated network with inband management that uses two factor authentication.
- CA logically isolated network with inband management that uses secure two factor
- DAn isolated network that provides secure out-of-band remote management.
How the community answered
(30 responses)- A3% (1)
- B10% (3)
- C3% (1)
- D83% (25)
Why each option
A SCADA-style management overlay is best characterized as an isolated network providing out-of-band remote management, keeping management traffic separate from production traffic. This architecture protects critical infrastructure controls from in-band compromise.
A physically isolated network for metric collection only describes monitoring, not full secure remote management, and overlooks the out-of-band management characteristic.
Inband management routes management traffic over the same network as production traffic, which defeats the core security purpose of the overlay despite having two-factor authentication.
A logically isolated network with inband management still shares the same physical medium as production traffic, providing weaker isolation than a true out-of-band solution.
Out-of-band management means the management plane is carried over a separate, dedicated network path entirely independent of the production data plane. This isolation prevents an attacker who compromises the production network from reaching management interfaces on SCADA and infrastructure devices.
Concept tested: Out-of-band management network architecture for SCADA
Source: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Topics
Community Discussion
No community discussion yet for this question.