ISA99 ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary purpose of the ISA99 series of standards?

   • ATo replace all other industrial network protocols with a single secure communication standard
   • BTo provide a certification program for cybersecurity professionals in industrial environments
   • CTo define a framework for developing and implementing secure industrial automation and control systems
   • DTo specify mandatory cybersecurity requirements for all industrial products sold globally
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A manufacturing company is redesigning its network. The IT network and the OT network are currently flat. The company wants to implement ISA99 zones and conduits. The OT network includes a robotic cell that must communicate with a historian in the IT network for reporting. What is the correct way to apply the zones and conduits model?

   • ACreate a single zone for all OT devices and a separate zone for all IT devices, with no conduit because the communication is one-way.
   • BUse a firewall as the conduit, and place the robotic cell and historian on opposite sides of the firewall without defining zones.
   • CPlace the robotic cell and the historian in the same zone because they need to communicate.
   • DCreate separate zones for the robotic cell and the historian, and connect them through a conduit that specifies the allowed communication and security controls.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A plant manager is reading about ISA99 and asks the security engineer: 'What is the main purpose of the ISA99 series?' Which response is most accurate?

   • ATo focus only on IT security and not on OT-specific concerns.
   • BTo mandate specific security products that must be used in all industrial environments.
   • CTo provide a framework for securing industrial automation and control systems through a risk-based approach.
   • DTo replace the need for risk assessments by providing a one-size-fits-all security level.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In the ISA99 zones and conduits model, what is a conduit?

   • AA communication path between zones that is subject to security controls
   • BA logical grouping of assets that share common security requirements
   • CA physical cable that connects two devices within the same zone
   • DA security device such as a firewall that filters traffic between networks
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A power generation company is performing an ISA99 risk assessment for its turbine control system. The system has a known vulnerability in the OPC server that could allow remote code execution. The company has a maintenance window next month. The risk assessment team must decide on a mitigation strategy. What is the most appropriate immediate action?

   • AApply the vendor patch immediately, even if it requires an emergency shutdown.
   • BImplement compensating controls, such as network segmentation and access restrictions, until the patch can be applied in the scheduled maintenance window.
   • CAccept the risk because the vulnerability is only exploitable by an attacker with network access.
   • DDisconnect the turbine control system from the network to eliminate the vulnerability.
   Reveal Solution Discussion Select an answer first