ISA99 ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   How are security levels (SL) used in the ISA99 framework?

   • ATo rank the physical security of a facility from 1 to 4
   • BTo categorize the required level of security for a system based on risk assessment
   • CTo determine the number of security zones needed in a network
   • DTo assign a fixed security level to all devices in a system regardless of risk
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In ISA99, which foundational requirement is concerned with ensuring that data is not modified or corrupted?

   • ASystem integrity
   • BUse control
   • CResource availability
   • DData confidentiality
   Reveal Solution Discussion Select an answer first
4. 28expert · medium

   A pharmaceutical company is conducting an ISA99 risk assessment for its new biologics manufacturing line. The line will use a mix of new and legacy equipment. The risk assessment identifies several vulnerabilities, including unpatched legacy HMIs and lack of network segmentation. The company has a limited budget and must choose between patching the HMIs and implementing segmentation. Which approach best aligns with ISA99's risk assessment methodology?

   • AAccept the risk because the line is new and the legacy equipment is isolated.
   • BPrioritize segmentation because it reduces the attack surface and limits lateral movement, which is a fundamental control.
   • CPrioritize patching the HMIs because they are directly accessible to operators and are a known vulnerability.
   • DDo both simultaneously, even if it exceeds the budget, because all vulnerabilities must be mitigated.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A water utility is designing a network for a new treatment plant. The engineering team wants to allow remote vendors to access the PLCs for diagnostics, but the security team insists on segmentation. They decide to create a 'Vendor Zone' and a 'Control Zone'. What is the most important requirement for the conduit between these two zones?

   • AThe conduit must allow all protocols to pass freely to avoid disrupting vendor diagnostics.
   • BThe conduit must be a dedicated physical cable to ensure complete isolation.
   • CThe conduit must be placed in the DMZ and monitored by a firewall only.
   • DThe conduit must enforce a security level (SL) that matches the higher of the two connected zones.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An energy company is defining security levels for its new wind farm control network. The risk assessment indicates that a cyber incident could cause a temporary loss of monitoring but no safety or environmental impact. According to ISA99, what is the most appropriate target security level for this network?

   • ASL 2, because any loss of monitoring is considered a serious impact.
   • BSL 1, because the consequence is limited to operational inconvenience.
   • CSL 4, because all control systems should be protected at the highest level.
   • DSL 3, because wind farms are critical infrastructure.
   Reveal Solution Discussion Select an answer first