Risk Management in ICS/SCADA ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of evaluating risks against organizational risk tolerance criteria?

   • ATo determine which risks are acceptable and which require mitigation
   • BTo eliminate all risks regardless of cost
   • CTo transfer all risks to third parties
   • DTo document risks for compliance purposes only
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A regional electrical grid operator has a legacy SCADA system that is critical for grid stability. The system has known unpatched vulnerabilities, and the vendor is no longer providing support. The operator is considering three options: (1) implement a firewall and IDS, (2) migrate to a modern SCADA system, or (3) accept the risk and rely on manual operations. The budget allows for only one option this year. Which option should the operator choose to best balance risk reduction and operational continuity?

   • AAccept the risk and rely on manual operations, since the system has operated without incident for years
   • BImplement a firewall and IDS to reduce the likelihood of exploitation while planning a migration
   • CDecommission the legacy system and use manual operations until a new system can be procured
   • DMigrate to a modern SCADA system immediately, even if it requires taking the grid offline for several weeks
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In an ICS/SCADA environment where historical incident data is scarce and the focus is on expert judgment, which risk assessment approach is most appropriate?

   • AQuantitative risk assessment
   • BPenetration testing
   • CQualitative risk assessment
   • DAutomated risk assessment
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A risk assessment for a wastewater treatment plant identified a high-risk vulnerability in the remote access solution. The security team needs to document the risk and communicate it to the operations manager. What should the documentation include?

   • AA list of all vulnerabilities, regardless of relevance.
   • BA detailed technical exploit walkthrough and proof-of-concept code.
   • CA summary of the risk, its potential impact on operations, and recommended mitigation actions.
   • DOnly the risk score and no further explanation.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A manufacturing company has identified a risk of ransomware affecting its production network. The likelihood is rated as 'high' and the impact as 'moderate' (production downtime for a few days). The company's risk tolerance is 'moderate'. What is the most appropriate risk response?

   • AAccept the risk because the impact is only moderate.
   • BMitigate by implementing network segmentation and offline backups.
   • CTransfer the risk by purchasing cyber insurance.
   • DAvoid the risk by disconnecting the production network from the internet.
   Reveal Solution Discussion Select an answer first