Life Cycle of a Vulnerability and Exploit ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A vulnerability in a building management system (BMS) was discovered by a researcher and disclosed to the vendor. The vendor has not yet released a patch. Meanwhile, a security researcher publishes a detailed analysis of the vulnerability, including a proof-of-concept exploit. The facility manager must decide how to respond. Which response best addresses the risk?

   • AIgnore the vulnerability because the exploit is only a proof-of-concept.
   • BDisconnect the BMS from the network entirely until the patch is available.
   • CImplement network segmentation and monitor for indicators of compromise while waiting for the patch.
   • DImmediately replace the BMS with a new system.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A water treatment facility runs a legacy HMI on a Windows 7 workstation that cannot be patched because the vendor no longer supports the OS. During a routine vulnerability scan, a critical remote code execution flaw is discovered in the HMI software. The facility's risk manager wants to reduce the likelihood of exploitation while a permanent fix is developed. Which action best aligns with the vulnerability life cycle stage between discovery and patch deployment?

   • AReplace the HMI with a newer model immediately, regardless of cost and operational impact.
   • BImmediately uninstall the HMI software and operate the process manually until a patch is available.
   • CWait for the vendor to release a patch and do nothing in the meantime because the vulnerability is only theoretical.
   • DApply a vendor-supplied configuration change that disables the vulnerable service and restrict network access to the HMI via firewall rules.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An ICS security manager must decide how to handle a critical vulnerability in a legacy SCADA server that is still in production. The vendor has released a patch, but applying it requires a full system restart that will interrupt a continuous chemical process. The process cannot be stopped for at least two weeks. The manager has the following options. Which option best balances security and operational continuity?

   • AApply the patch during the next scheduled maintenance window and implement compensating controls in the meantime.
   • BDo not apply the patch and rely on the system's existing security measures.
   • CReplace the SCADA server with a new one immediately.
   • DApply the patch immediately, accepting the process interruption.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A utility company has a vulnerability in a transformer monitoring system. The vendor has released a patch, but the patch requires a reboot that will cause a brief outage. The company decides to wait until the next scheduled maintenance window. What is the primary risk of this decision?

   • AThe vendor will withdraw the patch.
   • BThe system will automatically reboot itself.
   • CThe patch will become incompatible with the system.
   • DThe vulnerability remains exploitable until the patch is applied.
   Reveal Solution Discussion Select an answer first
6. 15application · easy

   An ICS environment has a vulnerability in a human-machine interface (HMI) that was discovered by a vendor during internal testing. The vendor has not yet disclosed the vulnerability publicly. What stage of the vulnerability life cycle is this?

   • ADiscovery
   • BPatch development
   • CExploitation
   • DDisclosure
   Reveal Solution Discussion Select an answer first