Life Cycle of a Vulnerability and Exploit ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A security team is creating a timeline for a vulnerability in a gas pipeline SCADA system. The events are: (1) vulnerability discovered, (2) vendor notified, (3) patch released, (4) exploit developed, (5) exploit used in an attack. Which timeline correctly orders these events?

   • A2 → 1 → 3 → 4 → 5
   • B1 → 3 → 2 → 4 → 5
   • C1 → 2 → 4 → 3 → 5
   • D1 → 2 → 3 → 4 → 5
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is evaluating the risk of a vulnerability in a PLC that is used in a nuclear power plant. The vulnerability has been disclosed, but no exploit is publicly available. The vendor has released a patch, but the plant cannot apply it during the current fuel cycle. Which factor most increases the risk of this vulnerability?

   • AThe vulnerability was disclosed by a researcher.
   • BNo exploit is publicly available.
   • CThe vendor released a patch.
   • DThe vulnerability is in a critical system that cannot be patched for an extended period.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which sequence correctly represents the typical timeline of a vulnerability and its exploit?

   • APublic disclosure → Vulnerability discovery → Patch release → Exploit development
   • BVulnerability discovery → Public disclosure → Exploit development → Patch release
   • CPatch release → Vulnerability discovery → Public disclosure → Exploit development
   • DVulnerability discovery → Exploit development → Public disclosure → Patch release
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst notices that a newly disclosed vulnerability in a building automation controller has a public exploit available within 24 hours of disclosure. The controller is used in a critical facility and cannot be patched immediately. What is the most immediate risk to the facility?

   • AThe vendor will stop supporting the controller.
   • BThe exploit will be used by attackers before the patch can be applied.
   • CThe vulnerability will automatically spread to other systems.
   • DThe facility will lose its cybersecurity insurance coverage.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security analyst at a power utility discovers that a zero-day exploit is being sold on a cybercriminal forum. The exploit targets a vulnerability in the utility's energy management system (EMS). The vendor is unaware of the vulnerability. The utility cannot afford to take the EMS offline. What is the most effective immediate action to protect the EMS?

   • ANotify the vendor and wait for a patch
   • BDisconnect the EMS from the network to prevent exploitation
   • CDeploy an intrusion prevention system (IPS) with custom signatures to detect and block the exploit
   • DPurchase the exploit from the forum to analyze it
   Reveal Solution Discussion Select an answer first