Security Policy ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A manufacturing company is developing a security policy for its ICS environment. The plant manager wants the policy to be approved by the end of the quarter. The security team has drafted the policy, but the OT engineers have not yet reviewed it. The compliance officer is pushing to publish immediately to meet the deadline. What is the best course of action?

   • ADelay publication until the OT engineers have reviewed the policy, even if it means missing the quarter-end deadline
   • BPublish the policy but mark it as 'draft' and ask OT engineers to comment within two weeks
   • CHave the compliance officer approve the policy on behalf of the OT engineers to meet the deadline
   • DPublish the policy now and incorporate OT feedback in the next revision cycle
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A manufacturing plant's security team drafted a new remote-access policy for its ICS network. Before publishing, the team held a review meeting with OT engineers, who objected that the proposed multi-factor authentication requirement would delay emergency troubleshooting during night shifts. What is the most appropriate next step in the policy development process?

   • AEscalate the objection to senior management and ask them to decide without further engineering input
   • BPublish the policy immediately because security requirements should not be weakened by operational convenience
   • CRemove multi-factor authentication entirely to ensure the policy is accepted by all parties
   • DRevise the policy to include an emergency-access exception procedure with compensating controls, then re-review with stakeholders
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A hospital's building management system (BMS) controls HVAC and access doors. The facilities director asks the security team to create a policy for the BMS. The director wants the policy to focus only on the IT network, arguing that the BMS is 'just a bunch of thermostats.' Which response best explains the role of a security policy for the BMS?

   • AThe policy should exclude the BMS because it is not connected to the internet and therefore poses no security risk
   • BThe policy should defer BMS security to the equipment vendor's documentation
   • CThe policy should cover the BMS only if it contains patient data, otherwise it is out of scope
   • DThe policy should explicitly include the BMS in its scope because it is an ICS that affects physical safety and availability, even if it is not traditional IT
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A manufacturing plant is implementing a new security policy that requires all control-system engineers to use multi-factor authentication (MFA) for remote access. The engineering manager objects, stating that MFA will slow down emergency response during off-hours. What is the most effective way to address this concern while maintaining policy compliance?

   • ADelay the policy until all engineers agree
   • BRemove the MFA requirement for off-hours remote access
   • CImplement a break-glass procedure with post-incident review
   • DRequire engineers to call the security team before every remote session
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is a security policy considered a foundational element of an ICS/SCADA defense-in-depth strategy?

   • AIt automatically configures all security devices to block malicious traffic without human intervention.
   • BIt provides the authority and framework for implementing layered technical and administrative controls.
   • CIt eliminates the need for ongoing security monitoring and incident response planning.
   • DIt is the only document required to achieve compliance with all ICS/SCADA regulations.
   Reveal Solution Discussion Select an answer first