Risk Management in ICS/SCADA ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A water treatment facility uses a legacy SCADA protocol that is unencrypted and has known vulnerabilities. The risk team must decide how to prioritize mitigation efforts. They have limited budget and cannot replace the protocol this year. Which approach best aligns with a risk-based prioritization strategy?

   • ADocument the vulnerability in the risk register and defer any action until the next annual review.
   • BImmediately replace all legacy devices with modern ones that support encrypted protocols, regardless of cost.
   • CApply compensating controls such as network segmentation and strict firewall rules to reduce the likelihood of exploitation while planning a protocol upgrade.
   • DIncrease the frequency of backups and rely on recovery procedures as the primary mitigation.
   Reveal Solution Discussion Select an answer first
2. 7application · medium · select all that apply

   After completing a risk assessment for a natural gas pipeline, the risk team must document and communicate the findings. Which of the following are essential elements of effective risk documentation and communication? Select all that apply.

   • AStore the risk assessment report in a secure location accessible only to the risk team
   • BTailor the communication to the audience, using non-technical language for management
   • COnly document the risks that were successfully mitigated
   • DInclude a clear description of each identified risk, its likelihood, and impact
   • EProvide recommendations for mitigation and next steps
   Check answers Discussion Select an answer first
4. 8expert · hard

   An oil refinery is required by corporate policy to conduct a quantitative risk assessment for all critical assets. However, the refinery has very limited historical incident data and the risk team is under pressure to deliver results within two weeks. Which approach best satisfies the policy while being realistic given the constraints?

   • ARefuse to conduct the assessment until sufficient historical data is collected
   • BUse industry-average data without adjusting for the refinery's specific context
   • CUse a hybrid approach: qualitative expert judgment to estimate likelihood and impact, then convert to quantitative values using a defined scale
   • DConduct a purely qualitative assessment and label it as quantitative to meet the policy
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In risk analysis, what does 'likelihood' refer to?

   • AThe cost of implementing security controls
   • BThe probability that a threat will exploit a vulnerability
   • CThe number of vulnerabilities in a system
   • DThe potential damage caused by an incident
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A utility has implemented a risk monitoring program that includes weekly reviews of security logs. However, they have not updated their risk assessment since the initial one two years ago. What is the most important action to improve their risk management?

   • AReplace all legacy systems with modern ones immediately.
   • BRely on the initial risk assessment since nothing has changed.
   • CIncrease the frequency of log reviews to daily.
   • DConduct a periodic risk assessment to account for changes in the environment and threat landscape.
   Reveal Solution Discussion Select an answer first