Security Policy ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A utility is updating its security policy to address new regulatory requirements for critical infrastructure. The policy team has drafted the updated document and received feedback from stakeholders. What is the next step in the policy maintenance process?

   • AImmediately publish the policy to all employees
   • BWait for a security incident to validate the policy
   • CArchive the old policy and stop enforcing it
   • DObtain formal approval from management and then communicate the policy
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An electric utility is writing a security policy for its distribution automation system. The policy team is debating which elements must be included. The compliance officer wants a list of specific firewall brand names, while the OT manager wants a statement of which systems are covered. Which combination of components should the policy actually contain?

   • AA list of approved firewall vendors and the IP addresses of all field devices
   • BA scope statement identifying the distribution automation system and a roles section defining who can access it
   • CA compliance statement and a list of all software versions running on the HMI servers
   • DAn objectives statement and a detailed network diagram with all communication paths
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A mid-sized utility is creating its first ICS security policy. The project sponsor wants to draft the document in one week and publish it without review. The security lead objects, citing the need for a structured development process. Which sequence best represents the correct policy development lifecycle?

   • ADraft the policy based on a template, publish it immediately, and update it only when an incident occurs
   • BHave the IT department write the policy in isolation, then send it to OT staff for a single round of comments before approval
   • CAssess risks and gather input from stakeholders, draft the policy, conduct a formal review, obtain management approval, then publish and schedule periodic reviews
   • DPublish a preliminary policy, collect feedback from employees for six months, then finalize it
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A pipeline company's security policy states that 'all remote access to the SCADA network must be through the approved VPN gateway.' An engineer connects directly to a field device using a cellular modem to troubleshoot a problem. What does this scenario illustrate?

   • AA compliance audit finding that is automatically resolved
   • BA violation of the security policy
   • CA policy exception that is acceptable because it is for troubleshooting
   • DA change to the policy scope
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A natural gas pipeline company has a security policy that assigns the control systems manager responsibility for approving all changes to the SCADA system. The IT security team has identified a critical vulnerability in the SCADA server and wants to apply an emergency patch. The control systems manager is on leave for two weeks. The pipeline is operating normally. What is the most appropriate action?

   • AApply the patch immediately without approval to protect the system
   • BDisconnect the SCADA system from the network until the manager returns
   • CUse the designated alternate approver or escalate to the CISO for emergency approval
   • DWait for the control systems manager to return and then apply the patch
   Reveal Solution Discussion Select an answer first