CFATS ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A covered chemical facility has completed its Security Vulnerability Assessment (SVA) and is now developing its Site Security Plan (SSP). The security manager wants to ensure the SSP will be approved by CISA. Which approach best aligns with CFATS requirements?

   • AAddress each applicable Risk-Based Performance Standard (RBPS) and describe how the facility will meet the performance measures.
   • BFocus only on physical security measures and omit cyber security because the facility has no networked control systems.
   • CSubmit the SSP directly to CISA without conducting a vulnerability assessment, since the SVA is optional for small facilities.
   • DDevelop the SSP using generic templates from other industries without tailoring to the facility's specific risks.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A covered chemical facility has submitted its Site Security Plan (SSP) to CISA. CISA has scheduled an inspection to verify the facility's compliance with the SSP and the Risk-Based Performance Standards (RBPS). During the inspection, CISA identifies a significant deficiency in the facility's cyber security measures. What is the most likely consequence?

   • ACISA will accept the SSP as is because the facility has made a good-faith effort.
   • BCISA will immediately revoke the facility's operating license and shut down operations.
   • CCISA will issue a notice of deficiency and require the facility to correct the issue within a specified timeframe.
   • DCISA will refer the matter to the EPA for enforcement under the Clean Air Act.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A facility stores 500 pounds of propane and 200 pounds of chlorine. The facility's safety manager is unsure if CFATS applies. The STQ for propane is 60,000 pounds and for chlorine is 2,500 pounds. What is the facility's obligation under CFATS?

   • AThe facility must submit a Top-Screen because it possesses any amount of a chemical of interest.
   • BThe facility must complete an SVA because it possesses chlorine, which is a high-risk chemical.
   • CThe facility is not covered because neither chemical is present at or above its STQ.
   • DThe facility is covered because it possesses two different chemicals of interest.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A covered chemical facility is developing its Site Security Plan (SSP). The facility's control system network is connected to the corporate IT network, and the engineering team wants to keep this connection for remote monitoring. Which Risk-Based Performance Standard (RBPS) consideration is most directly relevant to this design decision?

   • ARBPS 2 — Restrict Area Perimeter — which requires physical barriers around the facility.
   • BRBPS 8 — Cyber — which requires measures to deter, detect, and delay cyber attacks against critical cyber systems.
   • CRBPS 6 — Delay — which requires slowing down an attacker once they are inside the facility.
   • DRBPS 4 — Deter — which requires visible security measures to discourage potential attackers.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of the Site Security Plan (SSP) under CFATS?

   • ATo document how the facility will meet the Risk-Based Performance Standards (RBPS)
   • BTo list all chemicals stored at the facility
   • CTo serve as a training manual for facility employees
   • DTo provide a public record of the facility's security measures
   Reveal Solution Discussion Select an answer first