Selecting and Applying Controls to Mitigate Risk ICSSCADA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A natural gas pipeline company wants to implement a defense-in-depth strategy for its ICS. The company already has a perimeter firewall and an internal firewall between the IT and OT networks. Which additional control would most effectively strengthen the layered defense?

   • ADisable the internal firewall to reduce latency and improve performance.
   • BIncrease the password complexity requirement for all OT users.
   • CDeploy an intrusion detection system (IDS) on the OT network segment to monitor for anomalous traffic patterns.
   • DReplace the existing firewalls with a single, more powerful unified threat management (UTM) device.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A water utility has deployed a security information and event management (SIEM) system that collects logs from the SCADA network. The SIEM is generating a high volume of alerts, and the security team is overwhelmed. The team wants to prioritize alerts that indicate a real threat to the process. Which approach is most effective?

   • AAssign a single analyst to review all alerts manually.
   • BCreate correlation rules that combine multiple low-severity events into a single high-severity alert.
   • CIncrease the log collection rate to capture more data.
   • DDisable alerts for all but the most critical systems.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   During a risk assessment of an ICS network, a control gap is identified: an unauthenticated engineering workstation can directly access the PLCs in the control network. Which control selection BEST addresses this specific risk?

   • AInstalling a new firewall between the corporate and control networks
   • BImplementing multi-factor authentication on the engineering workstation
   • CConducting annual security awareness training for operators
   • DAdding a second UPS to the control room
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A pipeline company has an incident response plan that focuses on IT systems but does not address the SCADA environment. During a recent cyber incident, the SCADA operators did not know who to contact or what steps to take. Management wants to improve the incident response capability for the SCADA environment. What should be done first?

   • APurchase additional monitoring tools to detect incidents faster.
   • BHire an external incident response firm to handle all SCADA incidents.
   • CTrain the IT incident response team on SCADA systems and use the existing IT plan.
   • DDevelop a SCADA-specific incident response plan that includes roles, responsibilities, and communication procedures for control system incidents.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   An alarm system that alerts operators when an unauthorized change is made to a PLC's logic is an example of which control function?

   • ACorrective
   • BPreventive
   • CDetective
   • DDeterrent
   Reveal Solution Discussion Select an answer first