Challenges of Vulnerability Assessment ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A utility is subject to both NERC CIP and internal corporate security policies. The corporate policy requires monthly vulnerability scans, while NERC CIP requires quarterly assessments. What should the security team do?

   • AAsk NERC CIP to waive the quarterly requirement because the internal policy is stricter.
   • BPerform monthly scans but exclude NERC CIP assets to avoid conflicts.
   • CPerform only quarterly scans to comply with NERC CIP and ignore the internal policy.
   • DPerform monthly scans to satisfy the stricter internal policy, while ensuring they meet NERC CIP requirements.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is evaluating a vulnerability scanner for use in an OT environment. They need to minimize false positives. What feature should they prioritize?

   • AIntegration with IT ticketing systems for automated remediation.
   • BSupport for ICS-specific protocols and device fingerprinting.
   • CA large database of IT vulnerabilities.
   • DHigh scan speed to complete assessments quickly.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a common reason that ICS/SCADA systems cannot be patched immediately after a vulnerability is discovered?

   • AThe vulnerability scanner does not provide the exact patch name
   • BThe system is air-gapped, so patches cannot be downloaded
   • CPatching may require a system reboot, which would cause an unacceptable interruption to continuous production
   • DThe security team does not have permission to patch without board approval
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why do traditional IT vulnerability scanners often produce false positives when scanning ICS/SCADA devices?

   • AThey rely on generic signatures that may not match the actual behavior of proprietary ICS protocols
   • BThey are designed to find only configuration issues, not software vulnerabilities
   • CThey are too slow to keep up with the real-time nature of ICS traffic
   • DThey require credentials that are not available for ICS devices
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is tasked with assessing the vulnerability posture of a power utility's substation network. The network uses a mix of Ethernet/IP and a legacy proprietary protocol for remote terminal units (RTUs). The analyst runs a standard vulnerability scanner and finds only a handful of devices. What is the most likely reason for the incomplete results?

   • AThe scanner does not support the proprietary protocol used by the RTUs.
   • BThe scanner only scans for common vulnerabilities and misses the RTU-specific ones.
   • CThe RTUs are not connected to the network, so they cannot be scanned.
   • DThe scanner was configured with the wrong credentials for the RTUs.
   Reveal Solution Discussion Select an answer first