Selecting and Applying Controls to Mitigate Risk ICSSCADA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An ICS security team wants to detect an attacker who has moved laterally from the IT network into the OT network and is attempting to communicate with a historian server. The team has a limited budget and cannot deploy new hardware. Which monitoring control is most appropriate?

   • AInstall host-based intrusion detection software on the historian server.
   • BDeploy a new network intrusion detection system (IDS) on a SPAN port of the OT core switch.
   • CReview the historian's application logs once a week for failed logins.
   • DEnable logging on the OT firewall and configure alerts for any traffic from the IT zone to the historian subnet.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A food processing plant has a risk assessment that identifies a high risk of unauthorized personnel gaining physical access to the control room and connecting a laptop to the engineering network. Which combination of controls best mitigates this risk?

   • AIncrease the number of security cameras in the control room.
   • BInstall a badge reader on the control room door and require multi-factor authentication for all engineering network logins.
   • CPost a sign on the control room door stating 'Authorized Personnel Only'.
   • DDisable the network ports in the control room and rely on wireless access for engineering laptops.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A water treatment facility has a flat network where the SCADA HMI, PLCs, and engineering workstations all share the same subnet. The plant manager wants to reduce the risk of a malware infection spreading from the corporate IT network to the process control network. You are asked to implement a segmentation plan that isolates the process control network while still allowing the engineering team to remotely access the HMI for troubleshooting. Which approach best meets the requirement?

   • AConnect the corporate network directly to the process control network using a Layer 2 switch to reduce latency and simplify management.
   • BInstall antivirus on all engineering workstations and rely on host-based protection to prevent malware from crossing the network.
   • CPlace a firewall between the corporate network and the process control network, and create separate VLANs for the HMI, PLCs, and engineering workstations with restrictive rules between them.
   • DUse a single VLAN for the entire process control network and restrict access using IP-based access control lists on the core switch.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A pharmaceutical plant has a validated process control network that must remain compliant with good manufacturing practices (GMP). The plant wants to implement network segmentation to improve security, but any change to the network could require revalidation. What is the best approach?

   • AUse a router with access control lists instead of a firewall to avoid revalidation.
   • BImplement segmentation using a firewall that does not change the IP addresses or routing of the existing devices, and document the change for the validation package.
   • CSkip segmentation because revalidation is too costly.
   • DReconfigure all devices with new IP addresses to create clean segments.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A regional airport has a baggage handling ICS that is connected to the corporate IT network for reporting. A risk assessment shows that a ransomware infection on the IT network could spread to the ICS and halt operations. The airport cannot afford to completely disconnect the ICS from the IT network because the reporting is required by regulators. Which control strategy best balances the need for reporting with the need to protect the ICS?

   • AInstall antivirus on all ICS servers and workstations and enable automatic updates.
   • BMove the ICS to a cloud-based SCADA system to separate it from the IT network.
   • CCreate a VPN tunnel between the IT and ICS networks so that traffic is encrypted.
   • DImplement a one-way data diode for reporting traffic from the ICS to the IT network, and block all inbound traffic from the IT network to the ICS.
   Reveal Solution Discussion Select an answer first