Risk Assessment and Defining Types of Risk ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A manufacturing plant's risk assessment identifies two risks: (1) a ransomware infection on the IT network that could disrupt production scheduling (likelihood: high, impact: moderate), and (2) a failure of a redundant PLC power supply (likelihood: low, impact: high). The plant has a limited budget and must prioritize one risk for immediate treatment. Which risk should be prioritized?

   • AThe ransomware risk, because its higher likelihood results in a greater overall risk score
   • BNeither risk, because the budget is too limited to address either effectively
   • CBoth risks equally, because both have one high and one moderate factor
   • DThe PLC power supply risk, because impact is more important than likelihood
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of a risk register in risk documentation?

   • ATo store all security incident reports and forensic evidence
   • BTo record identified risks, their analysis, and planned treatment actions
   • CTo list all hardware and software assets in the organization
   • DTo provide a detailed network diagram of the ICS/SCADA environment
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is typically included in a risk register entry for a specific risk?

   • AThe vendor's product support phone number
   • BThe employee's performance review scores
   • CThe organization's marketing strategy
   • DRisk owner and treatment decision
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A power generation facility has a risk assessment matrix that scores likelihood and impact on a scale of 1 to 5. The team evaluates a risk of a phishing email leading to credential theft and remote access to the control network. They assign likelihood = 4 and impact = 5. The facility's risk tolerance threshold is a score of 15. What should the team do with this risk?

   • ATransfer the risk because the score is exactly at the threshold
   • BTreat the risk because the score exceeds the tolerance threshold
   • CAccept the risk because the score is below the threshold
   • DRe-evaluate the risk because the matrix is not applicable to phishing
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A risk committee is reviewing a list of risks from a risk assessment. The committee must decide which risks to treat first. They have the following information: Risk A has a likelihood of 4 and impact of 5; Risk B has a likelihood of 5 and impact of 4; Risk C has a likelihood of 2 and impact of 5; Risk D has a likelihood of 5 and impact of 2. Using a simple likelihood × impact scoring method, which risk should be treated first?

   • ARisk D
   • BRisk C
   • CRisk B
   • DRisk A
   Reveal Solution Discussion Select an answer first