ISA99 ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A power plant is implementing ISA99 zones and conduits for its turbine control system. The system has a turbine controller that communicates with a remote monitoring center via a satellite link. The remote monitoring center is operated by a third party. The plant wants to ensure that the remote monitoring center cannot send commands to the turbine controller. What is the most appropriate way to implement this using the zones and conduits model?

   • ADisconnect the satellite link because any remote access is a security risk.
   • BPlace the turbine controller and the remote monitoring center in the same zone because they communicate.
   • CCreate a separate zone for the remote monitoring center and use a conduit with a firewall that only allows monitoring data to flow from the plant to the remote center.
   • DUse a VPN to encrypt the communication between the turbine controller and the remote monitoring center.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A pharmaceutical company is implementing ISA99 foundational requirements for its new filling line. The system must ensure that only authorized operators can change recipe parameters, and that any changes are logged. Which combination of foundational requirements is most directly applicable?

   • AAccess control (AC) and audit (AU)
   • BUse control (UC) and data integrity (DI)
   • CSystem integrity (SI) and network segmentation (NS)
   • DData confidentiality (DC) and resource availability (RA)
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A manufacturing plant is implementing ISA99 guidance for securing its industrial network. The plant has a legacy PLC that cannot be patched. The PLC is in a zone with other devices that have been patched. What is the most practical implementation guidance for the legacy PLC?

   • AApply a virtual patch using an intrusion prevention system (IPS) in front of the PLC.
   • BDisconnect the PLC from the network and operate it in manual mode.
   • CPlace the legacy PLC in a separate zone with stricter access controls and monitor its traffic.
   • DReplace the legacy PLC immediately with a new one that can be patched.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A pharmaceutical company is performing an ISA99 risk assessment for its batch processing system. The system has a vulnerability in the batch controller that could allow an attacker to alter the recipe. The company has a strict regulatory requirement to validate any changes to the system. The risk assessment team is considering two countermeasures: (A) apply a vendor patch that requires a system restart, or (B) implement an application whitelist that blocks unauthorized executables. Which countermeasure is more appropriate given the regulatory validation requirement?

   • AApply both countermeasures because they address different aspects of the vulnerability.
   • BAccept the risk because the vulnerability is only exploitable by an insider.
   • CApply the vendor patch because it directly fixes the vulnerability.
   • DImplement application whitelisting because it does not require a system restart and can be validated more easily.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A chemical plant is implementing ISA99 security levels for its process control system. The system has a target security level (SL-T) of SL 2. The current security level (SL-C) is assessed as SL 1 because the system lacks user authentication and has no audit logging. The plant has a limited budget and must choose between two projects: (A) implement user authentication, or (B) implement audit logging. Which project should the plant prioritize to achieve SL 2?

   • ABoth projects should be implemented because SL 2 requires both authentication and audit logging.
   • BNeither project is necessary because the plant can accept the risk.
   • CProject A because authentication is a prerequisite for audit logging.
   • DProject B because audit logging is required to detect attacks, which is a key aspect of SL 2.
   Reveal Solution Discussion Select an answer first