Security Policy ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A power utility has a policy requiring all USB drives to be scanned before use on control-system workstations. An operator routinely skips the scan to save time. Which action would most effectively improve compliance?

   • AImplement technical controls that block un-scanned USB devices
   • BUpdate the policy to remove the scanning requirement
   • CDisable the USB ports on all control-system workstations
   • DVerbally remind the operator to follow the policy
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In the policy development process for an ICS/SCADA environment, why is it important to involve stakeholders from operations, engineering, and IT?

   • ATo ensure that the policy is written in highly technical language that only engineers can understand.
   • BTo allow each department to create its own separate and conflicting security policies.
   • CTo ensure the policy addresses operational realities and is practical for those who must follow it.
   • DTo avoid the need for management approval by having stakeholders sign off instead.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A mining company's ICS security policy includes a roles and responsibilities section that assigns the OT network administrator the duty of 'ensuring all firewalls are properly configured.' The administrator is also responsible for approving their own firewall changes. An auditor flags this as a segregation-of-duties issue. What is the best way to revise the policy to address this concern?

   • AAssign the approval duty to the IT security manager, who is not involved in OT operations
   • BKeep the combined role but require the administrator to document their own approvals in a log
   • CSeparate the roles so that one person configures firewalls and another person approves the changes, with the policy defining both roles
   • DRemove the approval requirement from the policy and rely on post-change audits
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A power generation company has a security policy that states 'the control network must be protected from unauthorized access.' The company is considering connecting the control network to the corporate network to allow real-time data sharing. The security team is concerned about the increased attack surface. What is the most important factor to consider when deciding whether to proceed?

   • AThe opinion of the corporate IT department
   • BThe cost of the network connection
   • CWhether the connection can be implemented with appropriate security controls, such as a firewall and intrusion detection
   • DThe age of the control system hardware
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A manufacturing company is revising its ICS security policy. The current policy is a single document that covers both IT and OT systems. The OT team complains that the policy is too IT-centric and does not address the unique requirements of the control network, such as availability and safety. The IT team argues that a single policy is simpler to manage. What is the best approach?

   • AEliminate the security policy and rely on technical controls
   • BAdopt the IT policy for OT systems to ensure consistency
   • CCreate two completely separate policies with no overlap
   • DKeep the single policy and add a section for OT-specific requirements
   Reveal Solution Discussion Select an answer first