ISA99 ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A chemical plant is updating its OT network. The safety instrumented system (SIS) is in a separate zone from the basic process control system (BPCS). The risk assessment shows that a successful attack on the SIS could cause a toxic release, but the SIS has no direct internet connectivity and is protected by a firewall. The plant wants to assign a security level to the SIS zone. What is the most appropriate way to determine the target security level (SL-T) for the SIS zone?

   • ASet the target SL to SL 4 because the consequence of a toxic release is severe, regardless of the current protections.
   • BAssign SL 1 because the SIS is isolated from the internet and the firewall already provides sufficient protection.
   • CPerform a risk assessment that considers the likelihood of a successful attack and the severity of the consequence, then select the SL that reduces the risk to an acceptable level.
   • DUse the highest SL that the existing firewall and segmentation can achieve, and document that as the target.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An organization is implementing ISA99 system security requirements for a new batch process control system. The system will have multiple operators with different roles. The security team wants to ensure that only authorized operators can change recipe parameters. Which ISA99 foundational requirement is most directly applied by implementing role-based access control on the HMI?

   • AUse control (UC)
   • BRestricted data flow (RDF)
   • CData integrity (DI)
   • DAccess control (AC)
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A chemical plant is performing an ISA99 risk assessment. They have identified a vulnerability in a chemical mixing process that could allow an attacker to alter the mixture ratio, leading to a toxic release. The current system has no authentication on the DCS. Which mitigation would be most aligned with ISA99's risk assessment methodology?

   • AInstall a firewall at the plant's internet connection to block external attackers.
   • BImplement strong authentication and authorization on the DCS to prevent unauthorized changes.
   • CAccept the risk because the plant has multiple layers of physical security.
   • DConduct a security awareness training for all operators.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In the ISA99 risk assessment methodology, what is the first step?

   • AConduct a vulnerability scan of all network devices
   • BSelect security countermeasures
   • CIdentify the system under consideration and its boundaries
   • DDetermine the security level of each zone
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A food and beverage plant is implementing ISA99 zones and conduits. The plant has a packaging line that is controlled by a PLC and a vision system that inspects packages. The vision system is a newer device that supports encrypted communication. The PLC is older and only supports unencrypted communication. The plant wants to place both devices in the same zone. What is the primary consideration when determining if they can be in the same zone?

   • AThey must support the same communication encryption protocols.
   • BThey must have similar security requirements, such as the same target security level.
   • CThey must be from the same vendor to ensure compatibility.
   • DThey must be on the same subnet to communicate efficiently.
   Reveal Solution Discussion Select an answer first