ICS/SCADA Security Model ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A wastewater treatment plant is implementing a security model. The plant has a limited budget and needs to prioritize controls. The most critical asset is the PLC that controls the chemical dosing. Which control should be implemented first?

   • AAn advanced intrusion detection system (IDS) for the entire corporate network.
   • BA comprehensive security awareness training program for all employees.
   • CA new HMI with a larger screen for better operator visibility.
   • DNetwork segmentation to isolate the PLC from other less critical systems.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A natural gas pipeline company is developing a security model for its ICS environment. The model must address both physical and cyber threats, and it must be scalable as the pipeline expands. Which component is essential for the model to be effective?

   • AA single, centralized firewall that protects the entire ICS network from external threats.
   • BA vendor-provided security solution that is guaranteed to protect against all known threats.
   • CA comprehensive risk assessment that identifies assets, threats, and vulnerabilities.
   • DA policy that requires all employees to use strong passwords and change them monthly.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A power utility is implementing a security model for its substation automation system. The engineers need to allow remote vendors to perform diagnostics on the protection relays (Level 0) from the corporate network (Level 4). The security team insists on a defense-in-depth approach. Which control combination best satisfies both operational needs and security requirements?

   • APlace the relays on the corporate network segment so vendors can access them without traversing multiple security layers.
   • BEstablish a jump host in a DMZ, require multi-factor authentication, and log all vendor sessions with an audit trail.
   • CUse a firewall rule that allows all traffic from the vendor's IP range to the relays during the diagnostic window.
   • DConfigure a direct VPN tunnel from the vendor's laptop to the relay's IP address for simplicity and low latency.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which security control is most appropriate for the boundary between the IT network and the ICS/SCADA network?

   • AA data diode that allows bidirectional traffic
   • BA firewall with strict access control rules and deep packet inspection
   • CA wireless access point configured with WPA2
   • DA network switch with no filtering capabilities
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A chemical plant has implemented network segmentation, firewalls, and an IDS. The security manager wants to add a layer of defense that specifically protects against an attacker who has already gained a foothold on a workstation in the control center. Which additional control best complements the existing measures in a defense-in-depth strategy?

   • AIncrease the frequency of full system backups to a tape library.
   • BDeploy an application whitelisting solution on all control center workstations.
   • CImplement a password policy requiring 15-character passwords changed every 30 days.
   • DAdd a second firewall between the control center and the plant floor.
   Reveal Solution Discussion Select an answer first