NIST SP 800-82 ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A regional water authority is planning a security assessment of its ICS. They must comply with both NIST SP 800-82 guidance and state regulations that require an independent evaluation every two years. What should they do to align with both requirements?

   • AUse NIST SP 800-82's assessment methodology and checklists as the basis for the biennial independent evaluation
   • BConduct only an internal self-assessment and skip the independent evaluation to save costs
   • CWait for the state regulator to provide a specific assessment template
   • DPerform a penetration test instead of a full security assessment
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the concept of defense-in-depth as applied to ICS security in NIST SP 800-82?

   • AUsing a single, strong security control to protect the entire system
   • BImplementing multiple layers of security controls so that if one fails, others still provide protection
   • CFocusing only on physical security measures
   • DPlacing all security devices at the network perimeter
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An auditor is reviewing the security of a wastewater treatment plant. The plant has a documented incident response plan, but the auditor finds that the plan has not been tested in over three years. According to NIST SP 800-82, what is the most appropriate recommendation?

   • AConduct a tabletop exercise or simulation of a cyber incident to validate and update the plan.
   • BFocus only on preventing incidents and ignore response planning.
   • CAssume the plan is still valid because it was written by a consultant.
   • DReplace the incident response plan with a new one every year without testing.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which activity is a key part of operating and maintaining security in an ICS environment according to NIST SP 800-82?

   • ADisabling logging to reduce system overhead
   • BContinuous monitoring of network traffic and system logs
   • CAvoiding software updates to prevent system downtime
   • DPerforming a one-time security assessment at system deployment
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During a security assessment of a chemical plant's DCS, the assessor discovers that the engineering workstation has a direct connection to the Internet and that several USB drives have been used to transfer files between the corporate network and the DCS. Which finding is most critical according to NIST SP 800-82?

   • AThe DCS does not have an incident response plan.
   • BThe direct Internet connection creates an unmanaged pathway for attackers to reach the DCS.
   • CThe engineering workstation is not running the latest antivirus definitions.
   • DThe USB drives could introduce malware from the corporate network.
   Reveal Solution Discussion Select an answer first