CAS-002 · Question #48
Capital Reconnaissance, LLC is building a brand new research and testing location, and the physical security manager wants to deploy IP-based access control and video surveillance. These two systems…
The correct answer is A. Develop a network traffic baseline for each of the physical security systems. Developing a network traffic baseline for each physical security system is the correct approach for determining NEW threats. A baseline establishes what normal, legitimate traffic looks like for each system (e.g., typical IP addresses, ports, protocols, data volumes, and…
Question
Capital Reconnaissance, LLC is building a brand new research and testing location, and the physical security manager wants to deploy IP-based access control and video surveillance. These two systems are essential for keeping the building open for operations. Which of the following controls should the security administrator recommend to determine new threats against the new IP-based access control and video surveillance systems?
Options
- ADevelop a network traffic baseline for each of the physical security systems.
- BAir gap the physical security networks from the administrative and operational networks.
- CRequire separate non-VLANed networks and NIPS for each physical security system
- DHave the Network Operations Center (NOC) review logs and create a CERT to respond to
How the community answered
(38 responses)- A71% (27)
- B3% (1)
- C18% (7)
- D8% (3)
Explanation
Developing a network traffic baseline for each physical security system is the correct approach for determining NEW threats. A baseline establishes what normal, legitimate traffic looks like for each system (e.g., typical IP addresses, ports, protocols, data volumes, and timing). Once a baseline exists, any deviation from it - unusual connection sources, unexpected protocols, spikes in traffic - can be flagged as a potential threat or anomaly, enabling proactive threat detection. Option B (air gapping) is an isolation control that prevents connectivity but does not help identify new threats. Option C (separate VLANs and NIPS) is a prevention/detection infrastructure but doesn't specifically address baselining to identify new unknown threats. Option D (NOC log review and CERT) is a reactive incident response capability, not a threat identification methodology.
Topics
Community Discussion
No community discussion yet for this question.