Risk Management in ICS/SCADA ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium · select all that apply

   A power generation facility has identified a high-risk vulnerability in its turbine control system. The risk assessment recommends reducing the risk to an acceptable level. Which of the following mitigation strategies are appropriate for this situation? Select all that apply.

   • AImplement network segmentation to isolate the turbine control system from other networks
   • BAccept the risk without any controls because the system has never been attacked
   • CApply vendor-recommended patches to the control system after testing in a non-production environment
   • DDisable the turbine control system until a permanent fix is available
   • EIncrease physical security around the turbine control room
   Check answers Discussion Select an answer first
2. 32expert · hard

   A manufacturing company has identified a critical vulnerability in its industrial control system that could allow an attacker to stop production. The vulnerability is in a third-party component that is used in multiple production lines. The company has a risk tolerance that allows for a maximum downtime of 4 hours per incident. The estimated downtime to patch the vulnerability is 6 hours per production line. What is the most appropriate risk treatment decision?

   • AAccept the risk and implement compensating controls to reduce the likelihood of exploitation
   • BPatch the vulnerability immediately, accepting the downtime
   • CIgnore the vulnerability because the likelihood of exploitation is low
   • DTransfer the risk by purchasing cyber insurance
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A chemical plant has implemented a risk mitigation plan that includes new firewall rules and access controls. The security manager wants to ensure that the controls remain effective over time as the threat landscape changes. Which activity is most important to include in the ongoing risk monitoring process?

   • AWait for an incident to occur before reviewing the controls
   • BPeriodically review firewall logs and access control lists to detect misconfigurations or unauthorized changes
   • CConduct a one-time penetration test after implementation and then stop testing
   • DRely on the vendor's assurance that the controls are effective without further review
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A pipeline company has implemented a risk monitoring program. They receive daily alerts from their IDS, but the security team is overwhelmed and often misses critical alerts. What is the most effective improvement to their risk monitoring process?

   • AIncrease the number of alerts by adding more IDS sensors.
   • BAssign a single analyst to review all alerts manually.
   • CTune the IDS to reduce false positives and prioritize alerts based on risk.
   • DDisable the IDS during peak production hours.
   Reveal Solution Discussion Select an answer first
6. 35application · medium · select all that apply

   A municipal water treatment plant has identified several vulnerabilities during a risk assessment. Which of the following are common threats/vulnerabilities specific to ICS/SCADA environments that should be considered? Select all that apply.

   • AInsider threats from disgruntled employees or unintentional errors
   • BExcessive use of cloud-based services for all control functions
   • CLegacy protocols that lack encryption and authentication
   • DLack of physical security for control room access
   • EInsecure remote access solutions used by vendors
   Check answers Discussion Select an answer first