CFATS ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A chemical facility has been found to be in violation of CFATS requirements. The facility's legal counsel is researching which federal agency has the authority to enforce CFATS and impose penalties. Which agency is responsible for CFATS enforcement?

   • AThe Occupational Safety and Health Administration (OSHA), under the Process Safety Management standard.
   • BThe Environmental Protection Agency (EPA), under the Clean Air Act.
   • CThe Department of Homeland Security (DHS), through the Cybersecurity and Infrastructure Security Agency (CISA).
   • DThe Department of Justice (DOJ), under the Patriot Act.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A chemical facility has just been notified by CISA that it is a covered facility under CFATS. The site security manager must complete the next required step. What should the facility do first?

   • ARequest a waiver from CFATS because the facility is small and has limited resources.
   • BDraft a Site Security Plan (SSP) and submit it to CISA for approval before conducting any vulnerability analysis.
   • CSubmit a Security Vulnerability Assessment (SVA) through the Chemical Security Assessment Tool (CSAT).
   • DImmediately implement all Risk-Based Performance Standards (RBPS) without any prior assessment.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A covered chemical facility has submitted its Site Security Plan (SSP) to CISA. CISA has reviewed the SSP and requested revisions. The facility is unsure why the SSP was not approved. Which reason is most likely for CISA requesting revisions?

   • AThe facility did not include a chemical inventory in the SSP.
   • BThe SSP was submitted in the wrong format, even though the content was correct.
   • CThe SSP did not adequately address all applicable Risk-Based Performance Standards (RBPS).
   • DThe SSP was too detailed and included more security measures than required.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Under CFATS, a chemical facility is subject to the regulation if it:

   • AManufactures any chemical product
   • BHas more than 100 employees
   • CPossesses any of the listed chemicals of interest at or above the threshold quantity
   • DIs located within 10 miles of a major city
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A covered chemical facility is updating its Site Security Plan (SSP). The facility's control system uses legacy protocols that are not encrypted, and the engineering team wants to replace them with modern encrypted protocols. Which RBPS element is most directly addressed by this change?

   • ARBPS 5 — Detect — which requires systems to detect security breaches.
   • BRBPS 1 — Restrict Area Perimeter — which requires physical barriers around the facility.
   • CRBPS 3 — Screen — which requires background checks for personnel.
   • DRBPS 8 — Cyber — which requires protecting critical cyber systems from cyber attacks, including securing communications.
   Reveal Solution Discussion Select an answer first