Risk Management in ICS/SCADA ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After completing a risk assessment for a natural gas pipeline, the risk team must present the findings to the operations director, who is not familiar with technical cybersecurity terms. What is the most effective way to communicate the risk information?

   • AShare the raw vulnerability scan output and ask the director to review it
   • BProvide a detailed list of all CVEs and exploit code references
   • CPresent a risk matrix with likelihood and impact ratings and explain the business impact in non-technical language
   • DOnly mention the risks that have a high likelihood, ignoring low-likelihood but high-impact risks
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A power utility has identified a risk of a cyber attack on its substation automation system. The likelihood is rated as 'possible' and the impact as 'severe' (loss of power to a city). The organization's risk tolerance is 'low'. What should the utility do?

   • ATransfer the risk to an insurance company.
   • BImplement additional security controls to reduce the risk to an acceptable level.
   • CAccept the risk because the likelihood is only possible.
   • DAvoid the risk by shutting down the substation.
   Reveal Solution Discussion Select an answer first
4. 28application · medium · select all that apply

   A chemical plant has implemented a risk monitoring program. Which of the following activities should be part of an effective continuous risk monitoring process? Select all that apply.

   • APerform a one-time risk assessment and never revisit it
   • BRegularly review security logs and alerts from ICS devices
   • CUpdate the risk assessment whenever a significant change occurs in the environment
   • DCommunicate risk monitoring findings to stakeholders on a regular basis
   • EConduct periodic vulnerability scans of the ICS network
   Check answers Discussion Select an answer first
5. 29application · medium

   A water utility has implemented a risk monitoring program that includes weekly vulnerability scans and monthly reviews of security incidents. However, the program does not include a process for updating the risk assessment when new vulnerabilities are discovered. What is the most important improvement to make?

   • AOnly update the risk assessment during the annual review
   • BIncrease the frequency of vulnerability scans to daily
   • CEstablish a trigger to re-evaluate the risk assessment when a new high-severity vulnerability is identified
   • DKeep the risk assessment static to avoid frequent changes
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An energy company has implemented a risk management program for its ICS. After an initial assessment, they want to ensure that new vulnerabilities in their remote access solution are quickly identified and addressed. Which practice best supports this goal?

   • AWait for the next annual risk assessment to identify changes.
   • BRely on the vendor's security advisories without internal verification.
   • CPerform a one-time penetration test and document the results.
   • DConduct continuous vulnerability scanning of the remote access gateway and review alerts weekly.
   Reveal Solution Discussion Select an answer first