Risk Assessment and Defining Types of Risk ICSSCADA Practice Questions (Page 9)

Questions 41–43

1. 41application · medium

   A water utility's SCADA system uses legacy Windows XP HMIs and unencrypted Modbus TCP between the control center and remote pumping stations. During a risk assessment, the team identifies that a successful exploit of the HMI could allow an attacker to alter pump setpoints, and that the Modbus traffic could be intercepted. Which type of risk does the unencrypted Modbus communication primarily represent?

   • ATechnical risk
   • BCompliance risk
   • COperational risk
   • DStrategic risk
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   A risk that arises from inadequate procedures or human errors in the control room is best classified as which type of risk?

   • ATechnical risk
   • BFinancial risk
   • CStrategic risk
   • DOperational risk
   Reveal Solution Discussion Select an answer first
3. 43application · medium

   A chemical plant has a legacy PLC that controls a critical reactor. The risk team has determined that a successful cyberattack on the PLC could cause a toxic release, but the likelihood of such an attack is very low because the PLC is not connected to any external network. According to risk analysis principles, how should this risk be characterized?

   • AHigh impact, low likelihood, resulting in a moderate risk score that may be accepted if the organization's risk tolerance allows
   • BLow impact, low likelihood, requiring no further action
   • CHigh impact, high likelihood, requiring immediate mitigation
   • DHigh impact, unknown likelihood, requiring a full penetration test before any decision
   Reveal Solution Discussion Select an answer first