Risk Management in ICS/SCADA ICSSCADA Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A natural gas company is starting a risk assessment for its SCADA system. They have limited historical incident data but have a team of experienced engineers who can provide subjective judgments. Which risk assessment methodology is most appropriate?

   • AQuantitative risk assessment using Monte Carlo simulation.
   • BSemi-quantitative assessment using ordinal scales and weighted scores.
   • CDefer the assessment until more incident data is collected.
   • DQualitative risk assessment using expert judgment to rate likelihood and impact.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the primary purpose of risk management in an ICS/SCADA environment?

   • ATo eliminate all possible risks to the control system
   • BTo transfer all risks to external insurance providers
   • CTo balance risk reduction with operational continuity and safety
   • DTo ensure the confidentiality of process data above all other priorities
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which of the following is an example of an insider threat in an ICS/SCADA environment?

   • AAn employee with legitimate access who accidentally changes a setpoint incorrectly
   • BA natural disaster such as a flood damaging a control room
   • CA vendor connecting a laptop to the control network for maintenance
   • DA hacker exploiting a vulnerability in a firewall from the internet
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A risk assessment for a nuclear facility has identified a high-impact risk that is currently rated as low likelihood. The risk manager must communicate this to the facility's safety committee, which is focused on operational safety and is skeptical of cybersecurity risks. What is the most effective communication strategy?

   • APresent the risk in terms of potential safety consequences and use analogies to physical safety risks
   • BFocus only on the low likelihood and downplay the risk to avoid alarming the committee
   • CPresent the risk as a purely IT issue that does not affect safety
   • DUse highly technical language to demonstrate the complexity of the risk
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A food processing plant uses a mix of modern and legacy PLCs. A risk assessment identified that an insider with physical access could plug a laptop into the control network and issue unauthorized commands. Which combination of controls would best mitigate this risk?

   • APhysical access controls (locks, badges) and network access control (NAC) on the control network.
   • BOnly install a firewall between IT and OT networks.
   • CImplement a strict password policy for all PLCs.
   • DUse only technical controls and ignore physical security.
   Reveal Solution Discussion Select an answer first