Risk Assessment and Defining Types of Risk ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the purpose of risk evaluation in the risk management process?

   • ATo identify all possible threats and vulnerabilities
   • BTo calculate the exact financial loss for each risk
   • CTo compare identified risks against criteria and prioritize them for treatment
   • DTo implement security controls to reduce risk
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A risk analyst is assessing the risk of a cyberattack on a wastewater treatment plant. The plant has a single internet-facing HMI that is protected by a firewall, but the firewall logs are not monitored. The analyst determines that the likelihood of a successful attack is moderate, and the impact is high because a failure could release untreated sewage. Management has a low risk tolerance. Which risk treatment option is most appropriate?

   • AAvoidance by disconnecting the HMI from the internet
   • BTransfer by purchasing cyber insurance
   • CMitigation by implementing firewall log monitoring and alerting, and conducting regular security reviews
   • DAcceptance because the likelihood is only moderate
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the context of ICS/SCADA network defense, what does a risk assessment primarily help an organization achieve?

   • AA detailed map of the network topology and all communication paths
   • BA guarantee that all vulnerabilities are patched immediately
   • CA complete inventory of all hardware and software assets
   • DA prioritized understanding of risks to critical industrial processes
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   During risk identification for an ICS/SCADA environment, which threat source should be considered as a potential risk?

   • AA change in the company's logo and branding
   • BA routine software update on a non-critical business server
   • CA disgruntled employee with physical access to control system workstations
   • DA marketing campaign that increases public awareness of the company
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In risk analysis, what two factors are typically used to determine the level of risk?

   • AThreat and asset value
   • BCost and benefit
   • CLikelihood and impact
   • DVulnerability and exposure
   Reveal Solution Discussion Select an answer first