NSE7_OTS-7.2 · Question #37
Refer to the exhibit. An operational technology (OT) network security audit concluded that the application sensor does not block the IEC.60870.5.104_Information.Trasfer.C.BO.NA.1 signature. Which…
The correct answer is C. Update the priority of the C.BO.NA.1 signature override to 1. The current configuration assigns priority 2 to the IEC.60870.5.104_Information.Transfer.C.BO.NA.1 application signature and sets it to Block. Priority 1 contains broader IEC.60870.5.104_Information.Transfer entries set to Monitor, which overrides the block action due to higher…
Question
Refer to the exhibit. An operational technology (OT) network security audit concluded that the application sensor does not block the IEC.60870.5.104_Information.Trasfer.C.BO.NA.1 signature. Which change must the OT network administrator make?
Exhibit
Options
- ASet all application categories to apply default actions.
- BChange the security action of the industrial category to monitor.
- CUpdate the priority of the C.BO.NA.1 signature override to 1.
- DRemove IEC.60870.5.104_Information.Transfer.C.BO.NA.1 from the first filter override.
How the community answered
(24 responses)- A4% (1)
- B13% (3)
- C75% (18)
- D8% (2)
Explanation
The current configuration assigns priority 2 to the IEC.60870.5.104_Information.Transfer.C.BO.NA.1 application signature and sets it to Block. Priority 1 contains broader IEC.60870.5.104_Information.Transfer entries set to Monitor, which overrides the block action due to higher priority. To ensure that the C.BO.NA.1 signature is blocked, it must have higher priority than the general monitoring rule.
Topics
Community Discussion
No community discussion yet for this question.