Challenges of Vulnerability Assessment ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why might an organization's vulnerability assessment scope be expanded beyond just technical scanning due to compliance pressures?

   • ARegulations require that all employees undergo security awareness training before any scan
   • BRegulations often require documentation of processes, risk acceptance, and remediation plans, not just a list of vulnerabilities
   • CRegulations require that the assessment be performed by an external vendor only
   • DRegulations require that all findings be published publicly
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A regional power utility is required by NERC CIP to conduct annual vulnerability assessments on its cyber assets. The utility has a legacy system that is not compliant with current CIP standards, and patching it would require a lengthy outage. What is the most appropriate approach to meet the regulatory requirement?

   • ADisconnect the legacy system from the network to avoid the assessment.
   • BSkip the assessment for the legacy system because it is not compliant anyway.
   • CImmediately patch the legacy system to achieve compliance, regardless of the outage.
   • DDocument the risk and implement compensating controls while planning for system replacement.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is using a specialized ICS scanner that supports multiple protocols. The scanner reports a high number of vulnerabilities on a particular PLC model. The team suspects false positives because the PLC is known to be patched. What is the best way to confirm whether the findings are true positives?

   • ARun the same scan multiple times to see if the results are consistent.
   • BManually verify the findings by comparing the scanner's output with the actual firmware version and patch level of the PLC.
   • CIgnore the findings because the PLC is known to be patched.
   • DUse a different scanner and compare the results.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is using a traditional IT vulnerability scanner to assess a SCADA network that uses Modbus TCP. The scanner reports a high number of critical vulnerabilities on a PLC, but the operations team insists the PLC is not vulnerable. What is the most likely explanation for the discrepancy?

   • AThe PLC has been patched, but the scanner is using an outdated vulnerability database.
   • BThe scanner is flagging the PLC based on its banner, which may be outdated or misleading.
   • CThe PLC is not actually running Modbus TCP, so the scanner is wrong.
   • DThe scanner is using the wrong credentials, so it cannot see the real version.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A food processing plant has an OT network that uses a mix of Ethernet/IP and a legacy proprietary protocol. The IT security team wants to run a vulnerability scan using their standard IT scanner. What is the most important consideration before proceeding?

   • AThe scanner will definitely crash the legacy devices.
   • BThe scanner will require credentials that the OT team does not have.
   • CThe scanner will generate too many false positives to be useful.
   • DThe scanner may not support the proprietary protocol, leading to incomplete coverage.
   Reveal Solution Discussion Select an answer first