Challenges of Vulnerability Assessment ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A regional transmission operator must comply with NERC CIP requirements for vulnerability assessments. What is the primary impact of this regulatory pressure on the assessment approach?

   • AIt eliminates the need for patch management because compliance is based on assessment only.
   • BIt prohibits any active scanning to avoid disruption, so only passive monitoring is allowed.
   • CIt requires the use of a specific commercial scanner to ensure consistency.
   • DIt mandates a specific schedule and scope for assessments, including all cyber assets within the electronic security perimeter.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is planning a vulnerability assessment for a chemical plant. The plant has a mix of modern and legacy devices, and some devices are safety-critical. The team wants to minimize operational impact while still identifying as many vulnerabilities as possible. What is the best approach?

   • AUse only passive monitoring and accept that some vulnerabilities may be missed.
   • BUse a specialized ICS scanner that supports all protocols and run it in passive mode.
   • CUse passive monitoring on all network segments and active scanning only on non-critical devices.
   • DRun an active scan on all devices during a maintenance window.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A water treatment plant uses a mix of modern PLCs and 20-year-old legacy RTUs communicating over a proprietary serial protocol. The security team wants to run a vulnerability scan. What is the most significant challenge they will face?

   • AThe scanner will need to be physically connected to each device because the network is air-gapped.
   • BThe scanner will require credentials for every device, which are not available for the legacy RTUs.
   • CThe legacy RTUs will crash if any packet is sent to them, so scanning must be avoided entirely.
   • DThe scanner will likely not understand the proprietary protocol, so it may miss vulnerabilities or generate false positives.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why must vulnerability scanning in a live ICS/SCADA environment be carefully scheduled and planned?

   • AVulnerability scanners require the plant to be shut down to produce accurate results
   • BActive scanning can cause unexpected loads or responses that disrupt critical processes or pose safety risks
   • CScheduling is only needed to ensure the security team is available to monitor the scan
   • DScanning is only allowed during business hours to avoid network congestion
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A manufacturing plant uses a legacy PLC that is known to have a critical vulnerability. The vendor is no longer in business, and the PLC controls a robotic arm that operates in a high-temperature environment. The security team proposes running an active vulnerability scan against the PLC to confirm the vulnerability. What should the team do first?

   • ARun the scan during a scheduled maintenance window when the robotic arm is offline.
   • BReview the PLC's technical documentation and consult with operations to understand the potential impact of scanning.
   • CImmediately scan the PLC to confirm the vulnerability before it is exploited.
   • DUse a passive scanner to avoid any risk of disruption.
   Reveal Solution Discussion Select an answer first