Life Cycle of a Vulnerability and Exploit ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A manufacturing plant uses a mix of modern and legacy PLCs. A vulnerability is disclosed in a legacy PLC model that the vendor no longer supports. The plant cannot replace the PLCs for six months. Which approach best manages the risk during the vulnerability life cycle?

   • ADisconnect the legacy PLCs from the network entirely and operate them locally.
   • BImmediately replace all legacy PLCs with modern ones, regardless of cost.
   • CSegment the network to isolate the legacy PLCs and monitor for anomalous traffic.
   • DIgnore the vulnerability because the PLCs are legacy and not worth the effort.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A vulnerability in a programmable logic controller (PLC) is disclosed with a proof-of-concept exploit. The vendor has not yet released a patch. Which statement best describes the relationship between the vulnerability and the exploit at this point?

   • AThe exploit eliminates the need to patch the vulnerability.
   • BThe vulnerability and exploit are unrelated.
   • CThe vulnerability is no longer a risk because the exploit is public.
   • DThe exploit increases the urgency to mitigate the vulnerability.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A cybersecurity consultant is helping a municipal water utility develop a vulnerability management timeline. The utility has a legacy SCADA system with a known vulnerability that has been exploited in the wild. The vendor is defunct, so no patch will be released. The utility plans to replace the system in 18 months. What should the consultant recommend as the primary risk mitigation strategy?

   • AImmediately replace the legacy system with a modern SCADA system
   • BImplement a virtual patch via an intrusion prevention system (IPS) and monitor the system closely
   • CDisconnect the legacy system from the network and operate manually
   • DAccept the risk because the system will be replaced in 18 months
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A vulnerability is discovered in a remote terminal unit (RTU) used in an electrical substation. The vendor has released a patch, but the patch has not been tested in the substation environment. What is the most appropriate next step in the vulnerability life cycle?

   • AWait for the next scheduled maintenance window without any interim measures.
   • BTest the patch in a lab environment that mirrors the substation setup before deploying it.
   • CDeploy the patch immediately to all RTUs to reduce risk.
   • DDisconnect the RTUs from the network until the patch is deployed.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How do vulnerabilities and exploits relate in their life cycles?

   • AAn exploit must be developed before a vulnerability can be discovered.
   • BA vulnerability must exist before an exploit can be developed for it.
   • CExploits are always created by the same vendor that discovers the vulnerability.
   • DVulnerabilities and exploits are independent and do not interact.
   Reveal Solution Discussion Select an answer first