A remote pump station has very limited bandwidth back to the operations center. How should that constraint shape the monitoring architecture?
Select an answer to reveal the explanation.
Short Explanation
A skinny pipe to the pump station can’t carry a firehose of PCAP forever. Keep smarts local, send the important alerts, and trim the chatter. Same high-volume collectors you’d run downtown will choke that rural link.
Full Explanation
Remote civic sites such as pump stations often sit behind constrained circuits. Monitoring architecture must respect that limit: aggregate and analyze locally where possible, prioritize actionable alerts, and ship lean telemetry instead of continuous full-packet capture that will saturate the link and starve operational traffic.
Streaming uncompressed PCAP continuously to the SOC regardless of capacity guarantees congestion and blind spots when the pipe fills. Cloning the main data center’s high-volume SIEM shippers assumes infinite WAN headroom the rural site does not have. Turning monitoring off because bandwidth is low abandons detection precisely where physical-process compromise is costly.
Exam caveat: “collect everything” is not a Security+ architecture answer when the scenario stresses limited bandwidth. Prefer filtering, sampling, local retention with selective upload, and severity-based forwarding over bulk raw capture across thin circuits.
Operational check: baseline link utilization with and without security exporters, set rate limits and local buffers, confirm critical OT/IT alerts still reach the SOC during peak SCADA chatter, and document what is retained onsite versus forwarded so incident responders know where to pull deeper evidence.