Life Cycle of a Vulnerability and Exploit ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   In the vulnerability life cycle, which stage immediately follows the discovery of a vulnerability by a researcher or vendor?

   • APatch deployment
   • BPatch development
   • CDisclosure
   • DExploitation
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A water utility discovers a vulnerability in its SCADA HMI software during an internal penetration test. The vendor has not yet released a patch, and the exploit code is already publicly available. The utility cannot take the HMI offline because it controls critical pumps. Which action best reduces risk while the vulnerability is in the 'patch not available' stage of its life cycle?

   • AApply vendor-recommended workarounds and restrict network access to the HMI
   • BImmediately disconnect the HMI from the network and operate pumps manually
   • CInstall a third-party patch that addresses the same vulnerability
   • DWait for the vendor patch and continue normal operations without changes
   Reveal Solution Discussion Select an answer first
4. 33application · easy

   A security team is tracking a vulnerability in a SCADA system. The timeline shows: vulnerability discovered by researcher, disclosed to vendor, vendor releases patch, and then a public exploit is released. What is the correct order of these events?

   • ADiscovery → Disclosure → Patch release → Exploit release
   • BDiscovery → Disclosure → Exploit release → Patch release
   • CDiscovery → Patch release → Disclosure → Exploit release
   • DDisclosure → Discovery → Patch release → Exploit release
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An ICS security team is building a timeline for a newly discovered vulnerability in a remote terminal unit (RTU). The vulnerability was found by a researcher, reported to the vendor, and a patch is expected in 60 days. The team wants to display the relationship between vulnerability disclosure and exploit availability. Which timeline correctly represents the typical progression?

   • ADiscovery → Exploit development → Disclosure → Patch release → Exploit deployment
   • BDiscovery → Disclosure → Patch release → Exploit development → Exploit deployment
   • CDisclosure → Discovery → Exploit development → Patch release → Exploit deployment
   • DDiscovery → Disclosure → Exploit development → Patch release → Exploit deployment
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst is assessing the risk of a vulnerability in a water treatment plant's control system. The vulnerability has been disclosed, but no exploit is publicly available. The vendor has released a patch, but the plant has not yet applied it. What is the most accurate risk assessment?

   • AThe risk is low because no exploit is publicly available.
   • BThe risk is zero because the vendor has released a patch.
   • CThe risk is moderate because a patch is available but not yet applied.
   • DThe risk is high because the vulnerability is disclosed.
   Reveal Solution Discussion Select an answer first