Life Cycle of a Vulnerability and Exploit ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security manager at a food processing plant is evaluating the risk of a vulnerability in the plant's programmable logic controllers (PLCs). The vulnerability is in the 'exploit available' stage, and the vendor has released a patch. However, the plant's insurance policy requires that all critical systems be patched within 30 days of patch release. The plant's change management process requires a 45-day testing period. What is the best course of action?

   • ARequest an expedited testing process from the change management board
   • BDeploy the patch immediately to meet the insurance requirement
   • CExtend the testing period to 45 days and accept the insurance penalty
   • DIgnore the insurance requirement and follow the standard testing period
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A natural gas pipeline operator has a vulnerability in its remote terminal units (RTUs) that is in the 'exploit available' stage of the life cycle. The vendor has released a patch, but the operator cannot deploy it immediately because the RTUs are in continuous operation. Which risk management approach is most appropriate during this stage?

   • ADeploy the patch during the next scheduled maintenance window
   • BReplace all RTUs with new models immediately
   • CAccept the risk because the RTUs are not internet-facing
   • DIgnore the vulnerability because the exploit is not publicly known
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In the timeline of a vulnerability and its exploit, which event typically occurs last?

   • AVulnerability discovery
   • BPatch deployment
   • CExploit development
   • DPublic disclosure
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A vulnerability in a SCADA protocol stack is discovered and disclosed. A security researcher publishes a proof-of-concept exploit that works only against a specific firmware version. The facility uses a different firmware version that is not affected. What is the most accurate assessment of the risk?

   • AThe risk is moderate because the exploit may be adapted to other versions.
   • BThe risk is unknown because the vendor has not released a patch.
   • CThe risk is low because the facility's firmware version is not vulnerable.
   • DThe risk is high because the exploit is public.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the typical relationship between the public disclosure of a vulnerability and the appearance of an exploit for it?

   • APublic disclosure prevents the development of exploits.
   • BExploits are usually developed before the vulnerability is publicly disclosed.
   • CExploits are only developed by the vendor that discloses the vulnerability.
   • DExploits are typically developed after the vulnerability is publicly disclosed.
   Reveal Solution Discussion Select an answer first