SANS 515 EXAM WITH CORRECT ACTUAL
QUESTIONS AND CORRECTLY WELL
DEFINED ANSWERS LATEST ALREADY
GRADED A+
Asset Identification on a Limited Budget - ANSWERS-
Identifying assets and documentation them does not have
to cost money: Paid products usually add ease, but it is
possible with open source or native tools.
Four Examples:
1. Physical Inspection: time consuming and difficult in large
environments
2. Traffic Analysis: Packet capture analysis safer for ICS
environments
3. Configuration File Analysis: Great approach to map
known assets
4. Scanning: Fast recommended only when in process
outage or when tuned with assistance of ICS supplier.
,Approach to Building a CMF - ANSWERS-1. Develop New
Requirements
2. Develop A Collection Plan
3. Implement
4. Test
5. Update Collection Plan
A CMF Security Controls as a Collection Profile - ANSWERS-
1. CMFs can be used as a collection package requirement
and paired with security controls that provide collection as a
standard profile across the organization
2. A Class site could require:
1. Host logging on HMIs, EWS, and Historians integrated to
the SIEM that collects high and medium priority events and
stored for 1 year
2. Network appliance for ICS protocol dissection and alerts
integrated with the SIEM and stored for 1 year
3. Multi-factor auth appliace with access logs to the SIEM
for 1 year
3. B Class
1. Network appliance for ICS protocol dissection and alerts
integrated with the SIEM and stored for 1 year
, 2. Multi-factor auth appliace with access logs to the SIEM
for 1 year
4. C Class
1. Multi-factor auth appliace with access logs to the SIEM
for 6 months
Generation Facility Inputs - ANSWERS-Inputs: uni-directional
to site
1. Project Files (lvl 2)
2. Files (data sheets, MSDS)
3. Firmware patches (lvl 1)
4. Purchased Hardware
5. Purchased software
6. Parts/equipment
7. Tools
8. Fuel supply
9. Labor/Contrators
10.Cooling water
11. Chemicals/materials
12. Deliveries
13. Mail (CD/DVDs/USB/letters)
QUESTIONS AND CORRECTLY WELL
DEFINED ANSWERS LATEST ALREADY
GRADED A+
Asset Identification on a Limited Budget - ANSWERS-
Identifying assets and documentation them does not have
to cost money: Paid products usually add ease, but it is
possible with open source or native tools.
Four Examples:
1. Physical Inspection: time consuming and difficult in large
environments
2. Traffic Analysis: Packet capture analysis safer for ICS
environments
3. Configuration File Analysis: Great approach to map
known assets
4. Scanning: Fast recommended only when in process
outage or when tuned with assistance of ICS supplier.
,Approach to Building a CMF - ANSWERS-1. Develop New
Requirements
2. Develop A Collection Plan
3. Implement
4. Test
5. Update Collection Plan
A CMF Security Controls as a Collection Profile - ANSWERS-
1. CMFs can be used as a collection package requirement
and paired with security controls that provide collection as a
standard profile across the organization
2. A Class site could require:
1. Host logging on HMIs, EWS, and Historians integrated to
the SIEM that collects high and medium priority events and
stored for 1 year
2. Network appliance for ICS protocol dissection and alerts
integrated with the SIEM and stored for 1 year
3. Multi-factor auth appliace with access logs to the SIEM
for 1 year
3. B Class
1. Network appliance for ICS protocol dissection and alerts
integrated with the SIEM and stored for 1 year
, 2. Multi-factor auth appliace with access logs to the SIEM
for 1 year
4. C Class
1. Multi-factor auth appliace with access logs to the SIEM
for 6 months
Generation Facility Inputs - ANSWERS-Inputs: uni-directional
to site
1. Project Files (lvl 2)
2. Files (data sheets, MSDS)
3. Firmware patches (lvl 1)
4. Purchased Hardware
5. Purchased software
6. Parts/equipment
7. Tools
8. Fuel supply
9. Labor/Contrators
10.Cooling water
11. Chemicals/materials
12. Deliveries
13. Mail (CD/DVDs/USB/letters)
