NIST SP 800-82 ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A power plant has a legacy control system that cannot be patched because the vendor is out of business. The plant must remain operational. The security manager is considering several compensating controls. Which combination of controls provides the most robust defense-in-depth for this unpatched system, according to NIST SP 800-82?

   • AIncreasing the frequency of backups and ignoring the vulnerability.
   • BNetwork segmentation, strict firewall rules, application whitelisting on the HMI, and continuous monitoring for anomalous behavior.
   • CDisabling the HMI and using only physical controls.
   • DInstalling a commercial antivirus product on the PLC.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A manufacturing company is developing an ICS security program for the first time. The security manager has been asked to ensure that the program aligns with NIST SP 800-82. Which sequence of actions best follows the guidance in NIST SP 800-82?

   • AConduct a risk assessment, develop a system security plan, implement security controls, and then monitor and assess the effectiveness of those controls.
   • BPurchase and deploy a next-generation firewall, then write a security policy to match the firewall configuration.
   • CHire an external auditor to perform a compliance audit before any security controls are in place.
   • DImmediately implement all security controls listed in NIST SP 800-82 without a prior risk assessment.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A water utility has implemented network segmentation and firewalls according to NIST SP 800-82. The security manager now wants to ensure that security monitoring is effective. Which practice is most aligned with SP 800-82's guidance for ICS operations?

   • ADeploy an intrusion detection system (IDS) on the control network and monitor for anomalies in ICS protocol traffic.
   • BDisable all logging on the HMI to reduce performance impact.
   • CUse only the corporate SIEM to monitor the control network without any ICS-specific sensors.
   • DRely solely on the firewall logs and review them once a month.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A cybersecurity analyst is evaluating the risk of a remote attacker exploiting a vulnerability in a PLC's web server. The PLC is on a segmented control network, but the analyst finds that the PLC's firmware is outdated and has known vulnerabilities. According to NIST SP 800-82, which combination of factors is most relevant to this risk?

   • AThe physical location of the PLC in the plant.
   • BThe number of employees in the IT department.
   • CThe vulnerability in the PLC, the exposure of the web server, and the lack of compensating controls such as patching or access restrictions.
   • DThe brand of the PLC and the color of the web server interface.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A water utility has implemented an IDS on its SCADA network. The IDS generates a large number of false positives, causing the security team to ignore alerts. The operations team is concerned that the IDS is also introducing latency. The security manager needs to improve the effectiveness of the monitoring program. Which action is most aligned with NIST SP 800-82?

   • ATune the IDS signatures and baselines to the specific ICS protocols and traffic patterns, and correlate alerts with a SIEM to reduce false positives.
   • BDisable the IDS to eliminate false positives and latency.
   • CIncrease the sensitivity of the IDS to catch more threats.
   • DReplace the IDS with a firewall that blocks all suspicious traffic.
   Reveal Solution Discussion Select an answer first