NIST SP 800-82 ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A mid-sized utility is upgrading its legacy SCADA system. The system must remain available 24/7, and the upgrade cannot cause any downtime. The security architect proposes implementing a new firewall and IDS, but the operations team is concerned about introducing latency. The architect must balance security and operational reliability. Which approach best aligns with NIST SP 800-82 while minimizing risk to availability?

   • AInstall the firewall in active mode immediately to protect the system as soon as possible.
   • BSkip the firewall and rely on the IDS to detect intrusions without blocking traffic.
   • CDisconnect the SCADA system from the network entirely to avoid any security risk.
   • DDeploy the firewall in a passive monitoring mode first, then gradually move to active enforcement during scheduled maintenance windows.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A power utility is implementing NIST SP 800-82 controls for its substation automation system. The system has a legacy HMI that cannot support modern authentication. The security team wants to add a technical control to reduce the risk of unauthorized access. Which control is most appropriate and aligned with SP 800-82?

   • AImplement a host-based intrusion detection system on the HMI.
   • BReplace the HMI with a modern one that supports strong authentication.
   • CPlace the HMI behind a firewall and require access through a jump host with multi-factor authentication.
   • DDisconnect the HMI from the network entirely and rely on physical access only.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst is reviewing the threat landscape for a power distribution company. The analyst is concerned about a sophisticated adversary that could target the control system. According to NIST SP 800-82, which characteristic of ICS makes them particularly vulnerable to such adversaries?

   • AMany ICS protocols lack authentication and encryption, and systems often run legacy software that cannot be easily patched.
   • BICS hardware is identical to standard IT hardware, making them easy to compromise.
   • CICS do not require any security controls because they are isolated.
   • DICS are always connected to the public Internet for remote monitoring.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An ICS security analyst is reviewing the network architecture of a natural gas pipeline. The analyst notices that the control center uses a standard IT protocol (e.g., Modbus/TCP) to communicate with remote field devices over a wide area network without any encryption. Which threat is most directly increased by this configuration, according to NIST SP 800-82?

   • AAn attacker could intercept and modify control commands in transit, potentially causing unsafe pipeline operations.
   • BThe control center could experience a denial-of-service attack from a competitor.
   • CThe field devices could be infected by a virus from the corporate email system.
   • DThe field devices would automatically fail to synchronize time with the control center.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An engineer is documenting the architecture of a manufacturing plant's control system for a security review. The system includes sensors, actuators, a PLC, and an HMI. According to NIST SP 800-82, which description best represents the basic control loop?

   • AActuators send data to the HMI, which then commands the sensors.
   • BSensors send process measurements to the PLC, which compares them to setpoints and sends commands to actuators to adjust the process.
   • CThe PLC only stores data and does not interact with field devices.
   • DThe HMI directly controls the actuators without any intermediate controller.
   Reveal Solution Discussion Select an answer first