Risk Assessment and Defining Types of Risk ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During a risk assessment at a power utility, the team identified three risks: (1) a phishing email that could give an attacker access to the corporate network, (2) a misconfigured firewall that allows unauthorized external access to the SCADA DMZ, and (3) a potential physical intrusion into an unmanned substation. The team must prioritize these risks for treatment. Which risk should be treated first?

   • AThe physical intrusion, because physical access always leads to full system compromise
   • BThe misconfigured firewall, because it exposes the SCADA network to external attackers with high likelihood and high impact
   • CThe phishing email, because it is the most common attack vector in the industry
   • DAll three risks should be treated simultaneously because they are equally important
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A power utility has identified a risk of a cyberattack on its grid control system. The cost to fully mitigate the risk is $2 million. The potential loss from a successful attack is estimated at $10 million, with a 10% annual likelihood. The utility is considering three options: (1) spend $2 million on mitigation, (2) purchase a cyber insurance policy for $500,000 per year, or (3) accept the risk. Which option is most financially justified?

   • ASpend $2 million on mitigation, because it eliminates the risk entirely
   • BCombine mitigation and insurance, because that provides the best protection
   • CAccept the risk, because the likelihood is low
   • DPurchase the insurance policy, because the annual premium is less than the annualized loss expectancy
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team has completed a risk assessment and identified several risks. Management wants to track the status of each risk, including the likelihood, impact, treatment decision, and the person responsible for implementing the treatment. Which approach best supports this requirement?

   • AEmail the list of risks to all managers and ask them to reply with their status
   • BCreate a spreadsheet listing only the risk names and whether they have been accepted or mitigated
   • CMaintain a risk register with columns for risk description, likelihood, impact, risk score, treatment decision, owner, and status
   • DStore the risk information in the incident response plan
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A chemical plant has two risks to evaluate: Risk A has a likelihood of 3 and an impact of 4 (score 12), but the impact includes a potential fatality. Risk B has a likelihood of 5 and an impact of 3 (score 15), but the impact is only financial. The plant's risk matrix uses a simple product for scoring, but the safety department argues that Risk A should be prioritized because of the potential loss of life. How should the risk evaluation be handled?

   • APrioritize Risk B because its numerical score is higher
   • BPrioritize Risk A because safety risks with potential fatalities should be treated with higher priority regardless of the numerical score
   • CDefer both risks until a full quantitative analysis is completed
   • DTreat both risks equally because they are close in score
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When an organization decides to purchase cyber insurance to cover potential losses from a cyber incident, which risk treatment option are they using?

   • AAcceptance
   • BAvoidance
   • CMitigation
   • DTransfer
   Reveal Solution Discussion Select an answer first