Risk Assessment and Defining Types of Risk ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of performing a risk assessment in an ICS/SCADA environment?

   • ATo guarantee that all identified risks are eliminated before any system is put into operation
   • BTo assign a monetary value to every asset in the ICS/SCADA environment
   • CTo identify, analyze, and evaluate risks to inform decisions on how to manage them
   • DTo document every possible threat that could ever affect the organization, regardless of likelihood
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A manufacturing company has completed a risk assessment and is updating its risk register. The team has identified a risk that was previously accepted but is now more likely due to new threat intelligence. The plant manager wants to change the treatment decision. What is the most appropriate action?

   • AUpdate the risk register with the new likelihood score and revise the treatment decision, documenting the rationale for the change
   • BKeep the original acceptance decision because the risk was already accepted
   • CDelete the risk from the register because it was already accepted
   • DWait until the next annual review to update the register
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A large electric utility is conducting a risk assessment for its transmission SCADA system. The assessment team has limited time and budget. Management wants to identify the most critical risks that could affect grid reliability. The team has access to historical incident data, threat intelligence feeds, and system architecture diagrams. Which approach best balances thoroughness with the constraints?

   • AUse a risk assessment framework to guide a structured analysis of assets, threats, and vulnerabilities, prioritizing based on likelihood and impact
   • BRely solely on historical incident data to identify risks that have occurred in the past
   • CInterview only the control room operators to gather their concerns
   • DFocus only on the most recent threat intelligence feeds to identify current attack trends
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A water treatment facility uses a legacy Windows 2000-based HMI that cannot be patched. The risk team has identified that a known remote-code-execution vulnerability in the HMI is exploitable from the corporate network. The facility cannot replace the HMI this year. Which risk treatment option best addresses the immediate risk while the replacement is pending?

   • ATransfer by purchasing a cyber-insurance policy that covers losses from a potential HMI compromise
   • BAvoidance by disconnecting the HMI from all networks and operating it in a standalone mode
   • CMitigation by placing the HMI on a separate network segment with strict firewall rules and disabling unnecessary services
   • DAcceptance by documenting the risk and scheduling a review in 12 months
   Reveal Solution Discussion Select an answer first
6. 25application · easy

   After completing a risk assessment for a wastewater treatment plant, the security team needs to document the findings and decisions. The plant manager wants a single document that tracks each identified risk, its likelihood and impact scores, the chosen treatment option, and the person responsible for implementing the treatment. Which document should the team use?

   • AIncident response plan
   • BRisk register
   • CNetwork topology diagram
   • DBusiness continuity plan
   Reveal Solution Discussion Select an answer first