Security Posture ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A regional water utility has a legacy SCADA system that cannot be patched without vendor approval, and the vendor is slow to respond. The utility has a limited budget and cannot afford a full replacement. They need to improve their security posture quickly. Which approach is most effective under these constraints?

   • AWait for the vendor to provide patches and do nothing in the meantime.
   • BReplace the legacy SCADA system with a modern one immediately.
   • CDisconnect the SCADA system from all networks to create an air gap.
   • DImplement network segmentation and monitoring to limit exposure of the legacy system.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard · select all that apply

   A power generation company is assessing its security posture. The company has a mix of legacy and modern systems, and the OT network is connected to the corporate network via a firewall. The assessment team has identified several potential weaknesses. Which of the following are VALID methods for assessing the security posture of this environment? (Select all that apply.)

   • APerforming an active vulnerability scan of all OT devices without prior testing
   • BConducting a passive network capture to inventory devices and protocols
   • CReviewing firewall logs to identify unauthorized traffic patterns
   • DDisabling the firewall temporarily to test the network's resilience
   • EInterviewing OT operators about their awareness of security policies
   Check answers Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a key component of an organization's security posture in an ICS/SCADA environment?

   • ASecurity policies and procedures that define how the organization manages and protects its systems.
   • BThe physical location of the corporate headquarters.
   • CThe number of employees in the IT department.
   • DThe brand of the firewall used at the network perimeter.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A chemical plant has a security posture that is strong on technical controls but weak on security awareness. Employees frequently fall for phishing emails, and there is no formal security training program. The plant wants to improve its posture but has a limited budget. Which initiative is most cost-effective?

   • ADisconnect the plant's email system from the internet to prevent phishing.
   • BHire a dedicated security awareness officer.
   • CPurchase an advanced email filtering solution to block phishing emails.
   • DImplement a security awareness training program and conduct simulated phishing exercises.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A manufacturing plant has a moderate security posture but wants to improve it. The plant has a strict change management process that requires all changes to be tested in a lab first. Which improvement strategy aligns with this constraint?

   • AImplement a security patch management process that tests patches in the lab before deployment.
   • BDeploy patches directly to production systems to speed up the process.
   • CHire an external team to apply patches without following internal procedures.
   • DSkip testing for security patches because they are critical.
   Reveal Solution Discussion Select an answer first