Risk Assessment and Defining Types of Risk ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A risk manager at a nuclear power plant is evaluating two risks: Risk X has a low likelihood but a very high impact (potential core damage), while Risk Y has a high likelihood but a low impact (minor equipment failure). The plant has a very low risk tolerance due to regulatory requirements. How should the risk manager prioritize these risks?

   • APrioritize Risk Y because the high likelihood means it will likely occur
   • BPrioritize Risk X because the impact is catastrophic, even though the likelihood is low
   • CTreat both risks equally because they have the same risk score if likelihood and impact are multiplied
   • DDefer both risks because the likelihood of Risk X is low and the impact of Risk Y is low
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security consultant is hired to perform a risk assessment for a hospital's ICS environment, which includes HVAC, lighting, and medical gas monitoring systems. The hospital has a limited budget and wants to focus on risks that could affect patient safety. Which approach should the consultant take?

   • AUse a generic risk assessment checklist from the internet without customization
   • BConduct a risk assessment that prioritizes systems based on their potential impact on patient safety, using a structured methodology
   • CPerform a vulnerability scan of all systems and fix all identified vulnerabilities
   • DFocus only on the medical gas monitoring system because it is the most critical
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A small water utility has identified that its SCADA system is vulnerable to a cyberattack that could disrupt water treatment. The utility cannot afford to upgrade the system, and management decides to accept the risk because the likelihood of an attack is low and the impact, while serious, is not life-threatening. Which risk treatment option has been applied?

   • AMitigation
   • BAcceptance
   • CAvoidance
   • DTransfer
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A petrochemical facility has a legacy DCS that controls a critical distillation column. The DCS has known vulnerabilities, but replacing it would cost $10 million and take two years. The facility is required to maintain production to meet contractual obligations. The risk team has identified that a cyberattack could cause a catastrophic release, but the likelihood is low because the DCS is isolated from the internet. Management is considering whether to accept the risk or implement compensating controls. What is the most appropriate decision?

   • ATransfer the risk by purchasing insurance, and take no other action
   • BImplement compensating controls, such as network segmentation and enhanced monitoring, to reduce the likelihood of a successful attack while planning for the DCS replacement
   • CAccept the risk because the likelihood is low and the cost of replacement is too high
   • DImmediately replace the DCS despite the cost and time, because the risk is unacceptable
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a risk specific to ICS/SCADA environments that is less common in traditional IT systems?

   • AMalware infection via email attachments
   • BData loss due to accidental file deletion
   • CUnpatched operating system vulnerabilities
   • DSafety system malfunctions due to unauthorized control commands
   Reveal Solution Discussion Select an answer first