CFATS ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How does CFATS address cybersecurity for chemical facilities?

   • AIt mandates the use of specific cybersecurity software products
   • BIt exempts facilities from cybersecurity requirements if they have physical security measures
   • CIt requires covered facilities to implement security measures to protect critical cyber systems
   • DIt requires facilities to report all cyber incidents to CISA within 24 hours
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A covered chemical facility is developing its Site Security Plan (SSP). The facility has a moderate risk tier and uses a mix of physical barriers and electronic access control. The security manager wants to ensure the SSP meets the Risk-Based Performance Standards (RBPS). Which action is most aligned with the RBPS?

   • AFocus only on physical security and ignore cyber security because the facility has no internet-connected systems.
   • BSubmit the SSP without a risk assessment because the facility has already implemented basic security measures.
   • CImplement the same security measures as a higher-tier facility to ensure compliance.
   • DConduct a risk assessment to determine the appropriate security measures for the facility's risk tier.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A covered chemical facility is updating its Site Security Plan (SSP). The facility uses a distributed control system (DCS) to manage chemical processes. The security manager wants to ensure the SSP adequately addresses cyber security. What should the SSP include?

   • AA reference to the facility's IT security policy without any specific measures for the DCS.
   • BA statement that cyber security is not applicable because the facility is not a critical infrastructure sector.
   • CA plan to disconnect the DCS from all networks and rely solely on physical security.
   • DA description of how the DCS is protected against unauthorized access and how cyber security risks are managed.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A chemical facility has just been preliminarily determined to be covered under CFATS. The facility must complete a Security Vulnerability Assessment (SVA). What is the primary purpose of the SVA?

   • ATo provide a detailed design for physical security upgrades that the facility must implement.
   • BTo identify and analyze the facility's vulnerabilities to terrorist attacks and other security risks.
   • CTo certify that the facility is in compliance with all CFATS requirements.
   • DTo determine the exact quantity of each chemical stored at the facility for inventory purposes.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A chemical facility has been preliminarily determined by DHS to be high-risk under CFATS. The facility's security manager is preparing the next required submission. What must the facility submit to DHS at this stage?

   • AA request for a waiver from CFATS requirements based on the facility's low risk.
   • BA Site Security Plan (SSP) that details the security measures the facility will implement.
   • CAn updated Top-Screen to confirm the facility's chemical inventory.
   • DA Security Vulnerability Assessment (SVA) that analyzes the facility's vulnerabilities, threats, and potential consequences of a terrorist attack.
   Reveal Solution Discussion Select an answer first