Risk Management in ICS/SCADA ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A utility company is evaluating two risks: Risk A has a high likelihood and low impact, while Risk B has a low likelihood and high impact. The company has a limited budget and must choose which risk to mitigate first. According to risk analysis principles, which approach is most appropriate?

   • AAlways mitigate the high-likelihood risk first, regardless of impact
   • BAlways mitigate the high-impact risk first, regardless of likelihood
   • CChoose the risk that is easier to mitigate, regardless of its score
   • DPrioritize based on the overall risk score, considering both likelihood and impact, and address the one with the highest score
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is risk management particularly important in ICS/SCADA environments compared to traditional IT systems?

   • ABecause failures can directly impact physical processes, safety, and the environment
   • BBecause ICS/SCADA systems are immune to traditional IT security controls
   • CBecause ICS/SCADA systems are always connected to the internet
   • DBecause risk management is a regulatory requirement only for ICS/SCADA
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which risk assessment methodology uses numerical values to estimate risk, such as annualized loss expectancy (ALE)?

   • ACompliance-based risk assessment
   • BHybrid risk assessment
   • CQuantitative risk assessment
   • DQualitative risk assessment
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A risk assessment for a mining operation has identified a high risk of a cyber attack on the hoist control system. The security team needs to communicate this to the mine manager, who is not technical. What is the best way to present the risk?

   • AUse a risk matrix showing likelihood and impact, with a clear explanation of potential safety consequences.
   • BProvide a detailed technical report with CVSS scores and exploit details.
   • CRecommend immediate shutdown of the mine to avoid the risk.
   • DOnly state that the risk is 'high' without further explanation.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of periodic risk reviews in an ICS/SCADA risk management program?

   • ATo assign blame for security incidents
   • BTo replace continuous monitoring activities
   • CTo update the risk assessment based on changes in the environment and lessons learned
   • DTo increase the frequency of security audits
   Reveal Solution Discussion Select an answer first