Security Policy ICSSCADA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A food processing company is writing a security policy for its ICS environment. The policy must define what systems are covered, who is responsible for updating antivirus definitions, and what happens if an employee fails to follow the policy. Which set of components should the policy include?

   • ARisk assessment, threat model, and compliance checklist
   • BNetwork diagrams, asset inventory, and incident response plan
   • CObjectives, budget, and vendor contracts
   • DScope, roles and responsibilities, and enforcement
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A natural gas distribution company is updating its ICS security policy. The previous policy was written five years ago and has not been reviewed since. The new policy must address modern threats, but the OT team is concerned that frequent updates will disrupt operations. The compliance team wants to ensure the policy remains current without imposing excessive review cycles. Which approach best balances these concerns?

   • AFreeze the policy for five years to provide stability and avoid operational disruption
   • BReview the policy only when a security incident occurs
   • CRewrite the policy completely every year to ensure it reflects the latest threat landscape
   • DEstablish a scheduled annual review cycle with a trigger for ad-hoc reviews after major incidents or significant infrastructure changes
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A large electric utility has a security policy that mandates all remote access to the SCADA network use the corporate VPN. The policy also requires that any exception be approved by the CISO in writing. During a storm, a field engineer needs immediate remote access to a substation RTU to restore power, but the VPN is down due to the storm. The engineer uses a direct cellular connection to the RTU to restore power. After the incident, the CISO reviews the action. What is the most appropriate outcome?

   • ATreat it as a policy exception and require a post-incident risk assessment
   • BIgnore the violation because the outcome was positive
   • CTerminate the engineer for violating the policy
   • DRetroactively change the policy to allow direct cellular access
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A food-processing company is deploying a new SCADA system and the plant manager asks the IT security lead to 'just write a quick policy so we can say we have one.' The security lead explains that a security policy serves a broader purpose in ICS defense. Which statement best captures that purpose?

   • AIt provides a step-by-step technical procedure for configuring every firewall and switch in the OT network
   • BIt replaces the need for risk assessments by mandating a fixed set of security controls for all ICS assets
   • CIt serves as a legally binding contract between the company and its ICS vendors regarding liability for breaches
   • DIt establishes the management-approved rules and expectations that guide all security decisions and user behavior across the ICS environment
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A transportation authority operates a rail signaling system. The security team is developing a policy and must decide how to handle the conflict between the safety team's requirement for immediate system access during emergencies and the security team's requirement for strict access controls. What is the most effective way to address this conflict in the policy?

   • AExclude emergency scenarios from the policy to avoid the conflict
   • BDefine an emergency-access procedure that grants temporary elevated access with mandatory post-incident review and audit logging
   • CPrioritize security by requiring full authentication and approval before any emergency access is granted
   • DPrioritize safety by allowing unrestricted access to all personnel during emergencies, with no logging requirements
   Reveal Solution Discussion Select an answer first