Security Policy ICSSCADA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A municipal water treatment plant is writing a security policy. The draft includes a section titled 'System Coverage' that lists the SCADA servers, HMIs, and network switches. The plant manager asks why the policy does not include the office desktops used by administrative staff. What is the best justification for this scope decision?

   • AThe policy should include all devices in the building, including office desktops, to be comprehensive
   • BOffice desktops are excluded because they do not contain sensitive data
   • CThe policy is scoped to the ICS environment, and office desktops are covered by a separate corporate IT policy
   • DOffice desktops are not at risk because they are not connected to the internet
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is it important for an ICS/SCADA security policy to explicitly define roles and responsibilities?

   • ATo ensure that every security task has an accountable owner and that personnel understand their duties.
   • BTo allow only the IT department to make all security decisions.
   • CTo assign blame to specific individuals when a security incident occurs.
   • DTo eliminate the need for security training by making roles self-explanatory.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a likely consequence of non-compliance with a security policy in an ICS/SCADA environment?

   • ANo consequences, as security policies are only advisory in nature.
   • BImmediate and automatic shutdown of all industrial processes.
   • CIncreased risk of unauthorized access, operational disruption, and potential regulatory penalties.
   • DLoss of all vendor support contracts regardless of the violation's severity.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A chemical plant's security policy requires all OT personnel to complete annual security awareness training. The training records show that 30% of shift operators have not completed the module, and the plant manager wants to know the consequence. According to the policy's compliance and enforcement section, what should happen?

   • AThe operators' OT network access should be suspended until training is completed, following the policy's stated enforcement mechanism
   • BThe training requirement should be removed from the policy because operators are too busy with production duties
   • CThe plant manager should verbally remind the operators and extend the deadline by another quarter
   • DThe compliance team should report the gap to the board but take no direct action against the operators
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A water utility has a security policy that requires all employees to report any security incident within one hour. An operator discovers that a contractor left a USB drive in a control-room computer, but the operator does not report it because the computer appears to be working normally. Later, malware is found on the control network. Which factor most likely contributed to the failure to report?

   • AThe policy did not define what constitutes a security incident
   • BThe policy required too much documentation
   • CThe contractor was not trained on the policy
   • DThe operator was not authorized to use the computer
   Reveal Solution Discussion Select an answer first