Risk Assessment and Defining Types of Risk ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard · select all that apply

   A regional airport's baggage handling system uses a mix of legacy and modern PLCs. During a risk identification workshop, the team identifies several potential risks. Which of the following are risks that are specifically relevant to ICS/SCADA environments? (Select all that apply.)

   • AAn employee accidentally spilling coffee on a server
   • BA vendor's remote support account using default credentials
   • CInsecure engineering workstation protocols that allow unauthorized changes to logic
   • DA phishing email targeting the HR department
   • EUnpatched firmware on PLCs that is no longer supported by the vendor
   Check answers Discussion Select an answer first
2. 7application · medium

   A hospital's building management system (BMS) controls HVAC and access doors. The IT department wants to conduct a risk assessment of the BMS, but the facilities team is concerned that the assessment might disrupt building operations. What is the best way to conduct the risk assessment without disrupting operations?

   • ARun active vulnerability scans during peak hours to get the most accurate results
   • BUse passive techniques such as reviewing architecture diagrams and interviewing operators, avoiding active scanning of live systems
   • CPerform the assessment only on the IT network, not the BMS
   • DSkip the risk assessment because the BMS is not critical
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During a risk analysis for a food processing plant, the team examines the possibility of a USB drive carrying malware being plugged into a plant floor HMI. They estimate that such an event occurs about once every two years, and that the resulting production downtime would cost $500,000 per incident. What is the annualized loss expectancy (ALE) for this risk?

   • A$500,000
   • B$1,000,000
   • C$250,000
   • D$250,000,000
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A manufacturing company has a critical production line that relies on a legacy PLC. The PLC has a known vulnerability that could allow an attacker to stop production. The company has three options: (1) patch the PLC, which requires a 4-hour downtime and may void the vendor warranty; (2) install an application whitelisting solution that blocks unauthorized executables; (3) disconnect the PLC from the network, which would require manual operation. Production cannot be stopped for more than 2 hours. Which option best balances security and operational constraints?

   • AInstall the application whitelisting solution, which reduces the risk without requiring extended downtime
   • BAccept the risk because no option is fully satisfactory
   • CDisconnect the PLC from the network and operate manually
   • DPatch the PLC, despite the 4-hour downtime, because it eliminates the vulnerability
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A regional electrical utility is planning to connect its SCADA network to a corporate IT network for better data analytics. Before making the connection, the security manager initiates a risk assessment. What is the primary purpose of this risk assessment in this context?

   • ATo document the network architecture and all device IP addresses
   • BTo guarantee that the connection will be completely secure and free of any risk
   • CTo identify and analyze potential risks introduced by the new connection so they can be evaluated and treated
   • DTo comply with a regulatory requirement without any practical benefit
   Reveal Solution Discussion Select an answer first