A water utility’s remote reservoirs rely on satellite and microwave backhaul that can be intercepted or spoofed. Which protection best addresses integrity and confidentiality for that data path?
Select an answer to reveal the explanation.
Short Explanation
Microwave and satellite hops are just long wireless hallways—anyone with the right gear can listen or inject if the traffic is naked. Wrap the backhaul in strong encryption and authentication so reservoir readings stay private and trustworthy. Taller towers, “secret” SCADA formats, and turning off integrity checks do not fix a cleartext radio path.
Full Explanation
Satellite and microwave backhaul carrying reservoir telemetry are exposed wireless media. Anyone with suitable RF equipment along the path can intercept or, in weaker designs, inject or alter frames if the payload rides in cleartext. Confidentiality and integrity therefore must be enforced cryptographically on the backhaul—authenticated encryption such as IPsec, or equivalent link-layer or application-layer protections—so readings and control-related messages cannot be read or silently modified in transit. Strong encryption plus authentication binds the channel to trusted endpoints and detects tampering that geographic isolation alone cannot prevent.
Raising antenna height may improve link budget and reliability, but elevation is not an interception countermeasure; RF still propagates and can be collected from unintended vantage points. Relying on proprietary SCADA frame formats as “obscurity” fails against determined observers who reverse protocols or simply capture ciphertext-free payloads for later analysis. Disabling integrity checks to shave latency on a satellite hop trades away the ability to detect spoofed or corrupted telemetry—an unacceptable trade for critical utility sensing where false data can drive wrong operational decisions.
Exam caveat: wireless WAN hops are not trusted pipes; treat them like any untrusted network segment and apply crypto proportionate to safety and confidentiality impact. Operational check: confirm backhaul uses approved authenticated encryption end to end, integrity is mandatory not optional, key management is documented, and test or monitoring can detect cleartext fallback or integrity bypass on the microwave/satellite path.