Risk Management in ICS/SCADA ICSSCADA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A food processing plant uses a legacy serial-based protocol for its PLCs. The protocol is vulnerable to spoofing, and the plant cannot afford to replace the PLCs this year. Which mitigation strategy would be most effective to reduce the risk of spoofing attacks?

   • AIncrease the baud rate of the serial connections to make spoofing harder
   • BRely on the physical security of the plant to prevent unauthorized access
   • CImplement network segmentation and restrict serial-to-Ethernet gateway access to authorized devices only
   • DDisable all serial ports on the PLCs to prevent any communication
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A hospital's building management system (BMS) controls HVAC and access doors. The IT department wants to apply the same security patches as they do for office workstations, but the BMS vendor warns that patches may disrupt critical operations. What is the most appropriate risk management action?

   • AConduct a risk assessment to evaluate the likelihood and impact of patching versus not patching, and decide based on the risk tolerance
   • BApply the patches immediately without testing to ensure security
   • CAsk the vendor to patch the system, but do not involve the IT department
   • DDo not patch the BMS at all to avoid any operational disruption
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A manufacturing plant uses Modbus TCP between PLCs and an HMI. A recent risk assessment identified that an attacker could send crafted Modbus packets to stop a production line. The plant cannot replace the legacy protocol due to cost. Which mitigation is most effective to reduce this risk?

   • AInstall antivirus on all PLCs to detect malicious packets.
   • BChange the Modbus TCP port to a non-standard value.
   • CSegment the Modbus network with firewalls that restrict traffic to known IP/port pairs.
   • DDisable all HMI alarms to prevent nuisance alerts during attacks.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A water utility is conducting a risk assessment for its SCADA system. The risk manager needs to prioritize risks that could cause loss of water pressure to customers. Historical failure data is sparse, but the utility has detailed engineering estimates of failure rates and the cost of downtime. Which approach best fits this situation?

   • AUse a quantitative risk assessment, calculating annualized loss expectancy from the engineering estimates.
   • BUse a qualitative risk assessment, rating likelihood and impact on a high/medium/low scale.
   • CSkip formal assessment and rely on vendor recommendations for all risks.
   • DUse a hybrid approach, combining qualitative ratings for safety impact with quantitative for financial loss.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which risk mitigation strategy involves sharing the risk with another party, such as through insurance?

   • ARisk reduction
   • BRisk transfer
   • CRisk avoidance
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first