Security Policy ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A power generation company's security policy mandates that all OT network changes be approved by the change advisory board (CAB). A shift engineer discovers a critical safety vulnerability and patches a PLC directly, bypassing the CAB, to prevent a potential explosion. The patch is successful. How should the compliance team handle this situation to best support both safety and policy adherence?

   • ALog the change as a routine change and do not mention the bypass to avoid drawing attention
   • BTreat it as an emergency change, document the rationale, and conduct a post-change review to validate the patch and update the change process
   • CDiscipline the engineer for violating the change policy, regardless of the safety justification
   • DUpdate the policy to remove the CAB approval requirement for all security patches
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A water utility's security policy requires all remote access to the SCADA network to use a VPN with multi-factor authentication. During a storm, a senior operator needs to access the system from home, but the MFA token is not working. The operator calls the IT helpdesk, which is closed. The operator's supervisor authorizes access without MFA to restore critical water pressure. What should the compliance team do after the incident?

   • AReview the incident, document the exception, and assess whether the policy needs an emergency fallback procedure for MFA failures
   • BIgnore the incident because the operator was authorized by the supervisor and the system was not compromised
   • CDiscipline the supervisor for authorizing access without MFA, as the policy is clear
   • DRemove the MFA requirement from the policy to avoid future conflicts during emergencies
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A pharmaceutical company is developing a security policy for its ICS environment. The company must comply with FDA regulations that require validation of any software changes. The IT security team wants to implement automated patch deployment to all control-system servers. The control engineering team objects, stating that automated patching could disrupt validated processes. The compliance officer notes that unpatched systems may violate FDA requirements for security controls. What is the best approach to reconcile these conflicting requirements?

   • ADo not patch control-system servers to avoid any disruption
   • BHave the IT team patch servers without informing control engineering
   • CDeploy patches automatically to all control-system servers immediately
   • DEstablish a patch-management process that includes testing, validation, and scheduled maintenance windows
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A pipeline operator's security policy states that all configuration changes to the OT network must be approved through a change-management ticket. During an audit, the reviewer finds that a control-system engineer applied a firmware update without a ticket, citing an urgent vendor advisory. The update was successful and no incident occurred. What should the compliance team do to best align with the policy's enforcement approach?

   • AIgnore the deviation because the update was successful and no security impact occurred
   • BIssue a formal written warning to the engineer and place a permanent note in their personnel file
   • CRevise the policy to remove the change-management requirement for vendor-advisory updates
   • DDocument the deviation as an emergency change, require a post-change review, and reinforce the policy through refresher training
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A pharmaceutical manufacturer has a security policy that requires all OT personnel to use individual accounts. However, a legacy packaging line uses a shared 'admin' account because the vendor's software does not support individual logins. The compliance team must enforce the policy without halting production. Which approach best satisfies both policy compliance and operational continuity?

   • AAllow the shared account but remove the individual-account requirement from the policy
   • BKeep the shared account but require each user to log in with their own username in a separate logbook
   • CDocument a formal exception for the legacy line, implement compensating controls such as a password vault and session logging, and plan a migration to individual accounts
   • DRequire the OT team to stop using the packaging line until the vendor upgrades the software
   Reveal Solution Discussion Select an answer first