ICS/SCADA Security Model ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   How does the defense-in-depth strategy apply to ICS/SCADA environments?

   • ABy implementing multiple layers of security controls so that if one layer fails, others still provide protection.
   • BBy relying on physical security measures to protect all ICS/SCADA assets.
   • CBy deploying a single comprehensive security product that addresses all vulnerabilities.
   • DBy focusing all security efforts on the perimeter firewall to block external threats.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A pipeline operator has implemented a defense-in-depth strategy. The current controls include a perimeter firewall, network segmentation, and an IDS. The security team wants to add a control that specifically detects malicious activity on the internal OT network that the perimeter firewall cannot see. Which control best fulfills this requirement?

   • ADeploy an internal network-based intrusion detection system (NIDS) on the OT network segments.
   • BAdd a second perimeter firewall between the OT network and the corporate network.
   • CImplement a strict password policy for all OT users.
   • DIncrease the logging level on the PLCs.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A water treatment facility has a network architecture where the SCADA servers, engineering workstations, and HMIs are on one flat network segment, and the business ERP system is on another segment with a firewall between them. The plant manager wants to improve security by separating the control system components from each other based on their functions. Which approach best aligns with the Purdue model and security zone principles?

   • AMove the ERP system into the same network segment as the SCADA servers to simplify management and reduce firewall complexity.
   • BPlace all control system components in a single zone and rely on the existing firewall to protect the entire control network.
   • CCreate separate zones for the SCADA servers, engineering workstations, and HMIs, with conduits controlling traffic between them.
   • DInstall a second firewall between the HMIs and the field devices, but keep the SCADA servers and engineering workstations on the same segment.
   Reveal Solution Discussion Select an answer first
5. 34application · easy

   A natural gas utility is documenting its network architecture. The system includes a gas chromatograph that measures gas quality, a PLC that controls the flow, an HMI in the control room, and a historian that stores quality data. According to the Purdue Model, which component is at Level 0?

   • AThe PLC
   • BThe gas chromatograph
   • CThe HMI
   • DThe historian
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A food processing plant is mapping its network to the Purdue Model. The plant has a warehouse management system (WMS) that tracks inventory and sends production schedules to the control system. The WMS is managed by the IT department. Which Purdue level best describes the WMS?

   • ALevel 1, because it controls the production process.
   • BLevel 2, because it sends schedules to the control system.
   • CLevel 4, because it is a business system that interacts with the control system.
   • DLevel 3, because it is part of the site operations.
   Reveal Solution Discussion Select an answer first