Security Policy ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A regional water utility is drafting its first ICS security policy. The compliance manager wants the policy to clearly state which personnel may authorize remote vendor access to the SCADA network and under what conditions. Which policy component must be explicitly defined to meet this requirement?

   • ARoles and responsibilities
   • BEnforcement and sanctions
   • CScope and applicability
   • DObjectives and goals
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An ICS security policy states: 'All changes to the human-machine interface (HMI) software must be approved by the control systems manager and documented in the change log.' Which policy component does this statement primarily represent?

   • AEnforcement mechanism
   • BScope
   • CObjective
   • DPolicy rule
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the context of ICS/SCADA network defense, what is the primary role of a security policy?

   • ATo replace the need for risk assessments by prescribing a fixed set of security measures for all ICS/SCADA systems.
   • BTo define the exact technical configuration settings for every firewall and router in the ICS/SCADA network.
   • CTo serve as a legally binding contract between the organization and its ICS/SCADA vendors.
   • DTo provide a high-level statement of management intent that guides the selection and implementation of security controls.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which sequence best represents the typical steps in developing an effective security policy for an ICS/SCADA environment?

   • AWrite the policy, distribute it to all employees, and then immediately delete all previous security documents.
   • BPurchase security software, configure it, then write the policy to match the software's capabilities.
   • CDraft the policy, obtain management approval, communicate the policy, implement, and periodically review and update.
   • DConduct a single annual review without any initial drafting or approval process.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A water treatment facility's security policy requires all operators to complete annual security awareness training. The facility manager wants to verify that all operators have completed the training. Which method is most appropriate for confirming compliance?

   • AAsk operators to self-report their training completion
   • BConduct a random quiz on security topics
   • CAssume compliance unless an incident occurs
   • DReview training records and completion certificates
   Reveal Solution Discussion Select an answer first