Risk Assessment and Defining Types of Risk ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A pipeline operator is analyzing the risk of a cyberattack on its leak detection system. The team has two data sources: (1) threat intelligence shows that similar attacks have occurred in the industry, but (2) the company's own security monitoring has not detected any attempts. The team must decide how to rate the likelihood of this risk. What is the most appropriate approach?

   • AUse the threat intelligence as the primary basis, but adjust for the company's specific environment and monitoring capabilities
   • BRate the likelihood as high because threat intelligence indicates the threat exists
   • CIgnore the threat intelligence because the company has not seen attacks
   • DRate the likelihood as low because the company has not detected attacks
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A risk analyst is evaluating the risk of a ransomware attack on a hospital's building management system (BMS). The analyst estimates that the attack could shut down HVAC systems for 48 hours, affecting patient comfort but not life-safety systems. The likelihood of the attack is moderate because the BMS is on a separate network but has some internet exposure. How should the analyst characterize the risk?

   • AHigh likelihood and low impact, requiring only acceptance
   • BLow likelihood and low impact, requiring no action
   • CHigh likelihood and high impact, requiring immediate emergency action
   • DModerate likelihood and moderate impact, resulting in a medium risk that should be monitored and possibly mitigated
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large utility is planning to integrate its OT network with a new cloud-based analytics platform. The security team is asked to perform a risk assessment before the integration. The team is divided: some want to do a full quantitative risk assessment, while others prefer a qualitative approach. The project timeline is tight, and the integration is scheduled to go live in three weeks. What is the most appropriate approach?

   • ADelay the integration until a full quantitative risk assessment is completed
   • BConduct a qualitative risk assessment focused on the highest-impact risks, and document assumptions for later quantitative analysis
   • CPerform a full quantitative assessment but only on the cloud platform, not the OT network
   • DProceed with the integration without a risk assessment because the timeline is tight
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A small brewery's automation system uses a PLC that is no longer supported by the vendor. The risk assessment shows that a failure of the PLC would halt production for a week, costing $100,000. The brewery has a limited budget and decides that the cost of replacing the PLC ($150,000) is not justified. They decide to keep the PLC and accept the risk. What should the team document in the risk register?

   • AThe risk is avoided by shutting down the brewery
   • BThe risk is mitigated by implementing a monitoring system
   • CThe risk is accepted, with the rationale that the cost of mitigation exceeds the potential loss
   • DThe risk is transferred to the PLC vendor
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A municipal water utility is conducting a risk identification workshop. The team lists the following potential risks: (1) a disgruntled former employee using still-valid VPN credentials, (2) a flood damaging the primary control room, (3) a ransomware attack on the billing system, and (4) a vendor's remote maintenance session being hijacked. Which of these is a threat specifically tied to the ICS/SCADA environment rather than a general IT risk?

   • AA vendor's remote maintenance session being hijacked
   • BA flood damaging the primary control room
   • CA disgruntled former employee using still-valid VPN credentials
   • DA ransomware attack on the billing system
   Reveal Solution Discussion Select an answer first