ICS/SCADA Vulnerabilities ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A chemical plant has a vulnerability in the safety instrumented system (SIS) that could allow an attacker to disable safety interlocks, and another vulnerability in the process control system (PCS) that could allow an attacker to alter setpoints. The plant is currently running at reduced capacity due to maintenance. Which vulnerability should be prioritized?

   • AThe SIS vulnerability, because disabling safety interlocks could lead to a catastrophic release of hazardous chemicals.
   • BThe PCS vulnerability, because altering setpoints could affect product quality and production efficiency.
   • CThe PCS vulnerability, because it is more likely to be exploited by an attacker seeking financial gain.
   • DBoth equally, because both are in the same plant and have similar risk levels.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A pharmaceutical plant uses a DCS with proprietary protocols and legacy Windows-based HMIs that cannot be patched because the vendor has not validated updates. The plant runs 24/7 and production stoppages are extremely costly. Which mitigation strategy best balances security and operational continuity?

   • AApply the latest Windows updates immediately to all HMIs to close known vulnerabilities.
   • BDisconnect the DCS from all networks and operate the plant manually until patches are available.
   • CSegment the DCS network with firewalls and implement application whitelisting on the HMIs to block unauthorized executables.
   • DReplace the HMIs with modern systems that are fully patched and supported.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A wastewater treatment plant uses a serial connection between a PLC and a radio modem for remote monitoring. The radio link is unencrypted, and an attacker could intercept and modify messages. The plant cannot afford to replace the radio system. Which mitigation is most appropriate?

   • AImplement a message authentication code (MAC) at the application layer on the PLC and the monitoring station.
   • BUse a frequency-hopping spread spectrum radio system.
   • CDisable the radio modem and use manual readings.
   • DIncrease the transmit power of the radio modem.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A power distribution company has a limited budget for security improvements. Two vulnerabilities are identified: (1) a remotely exploitable buffer overflow in the substation RTU that could cause a reboot, and (2) a lack of encryption on the communication link between the control center and the substation, which could allow eavesdropping on operational data. The RTU reboot would cause a temporary loss of monitoring but not a loss of control. Which mitigation should be funded first?

   • APurchase a backup RTU to have on hand.
   • BPatch the RTU firmware to fix the buffer overflow.
   • CDeploy encryption on the communication link.
   • DImplement network segmentation to isolate the substation.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which mitigation strategy is most appropriate for an ICS/SCADA system that cannot be patched immediately due to operational constraints?

   • AIgnore the vulnerability until the next scheduled maintenance window
   • BApply the patch immediately without testing
   • CImplement network segmentation and firewall rules to limit access to the vulnerable system
   • DDisconnect the system from the network permanently
   Reveal Solution Discussion Select an answer first