Security Policy ICSSCADA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which approach is most effective for ensuring compliance with an ICS/SCADA security policy?

   • AApplying the same enforcement measures to all personnel regardless of their role.
   • BRegular audits, automated monitoring, and clearly communicated consequences for non-compliance.
   • CRelying on employees to voluntarily follow the policy without any oversight.
   • DMaking the policy confidential so that only a few people know its contents.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A chemical plant is developing a security policy for its distributed control system (DCS). The policy team includes IT security staff, control engineers, and plant management. During the first draft, the IT team proposes strict password rotation every 30 days, but control engineers warn that frequent changes increase the risk of lockouts during production. What is the best next step in the policy development process?

   • AConduct a risk assessment and pilot the policy in a non-production environment
   • BPostpone the policy until a security incident occurs
   • CAdopt the IT proposal as written to ensure strong security
   • DLet each department write its own policy
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a key component that should be included in an ICS/SCADA security policy?

   • AA detailed step-by-step procedure for responding to every type of incident.
   • BThe exact brand and model of security appliances that must be purchased.
   • CA clear statement of scope, defining which systems, networks, and personnel are covered by the policy.
   • DA list of every possible security threat and vulnerability affecting the organization.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A regional water utility is drafting its first ICS security policy. The compliance manager insists the policy must include a section listing every employee's name and their specific login credentials for the SCADA HMI. The OT manager argues this is inappropriate. Which policy component should the OT manager reference to justify excluding individual credentials while still defining access expectations?

   • ACompliance section that lists penalties for sharing passwords among shift operators
   • BScope section that limits the policy to network devices and excludes all host-level authentication details
   • CObjectives section that states the goal of preventing unauthorized access without specifying implementation details
   • DRoles and responsibilities section that assigns access rights by job function rather than by individual identity
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A manufacturing company's security policy states that 'all access to the control network must be authenticated and authorized.' An employee uses a shared account to log in to a PLC programming workstation. What is the primary security policy issue?

   • AThe shared account does not allow individual accountability
   • BThe workstation is not patched
   • CThe employee is not authorized to use the workstation
   • DThe employee is not using multi-factor authentication
   Reveal Solution Discussion Select an answer first