Selecting and Applying Controls to Mitigate Risk ICSSCADA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A pharmaceutical company runs a validated manufacturing execution system (MES) that must remain compliant with FDA regulations. The vendor releases a critical security patch for the underlying operating system, but the patch has not been validated for the MES application. The plant must maintain production uptime and regulatory compliance. What is the most appropriate action?

   • AApply the patch only to non-critical servers and leave the MES servers unpatched.
   • BApply the patch immediately to all MES servers to eliminate the vulnerability, then document the change.
   • CTest the patch in a non-production environment that mirrors the MES configuration, and if successful, schedule the patch during a planned maintenance window.
   • DDo not apply the patch because the MES is air-gapped and not exposed to external threats.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A power utility runs a legacy SCADA system on Windows Server 2008 R2. The vendor has released a security patch, but the patch is known to cause a brief interruption to the HMI polling service during installation. The plant cannot tolerate downtime during peak hours. What is the best approach to apply this patch?

   • AApply the patch immediately without notifying operations, because security is the top priority.
   • BDo not apply the patch because the system is legacy and the risk of downtime is too high.
   • CApply the patch to a test environment first, then skip the production patch if the test passes.
   • DSchedule the patch installation during a planned maintenance window when production is at its lowest, and have a rollback plan ready.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the PRIMARY purpose of network segmentation in an ICS environment?

   • ATo simplify the process of patching all systems from a single console
   • BTo increase network bandwidth for critical applications
   • CTo eliminate the need for firewalls in the network
   • DTo isolate critical control systems from less trusted networks and limit the impact of a compromise
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An ICS risk assessment identifies that a legacy HMI runs on an unsupported operating system with known remote code execution vulnerabilities. Which control selection is the MOST appropriate to mitigate this risk?

   • AAdding a second firewall at the internet boundary
   • BIsolating the HMI on a separate network segment with strict access rules
   • CIncreasing the frequency of full system backups
   • DDeploying an intrusion detection system on the control network
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A regional electrical utility has experienced a ransomware attack that encrypted the engineering workstations and the SCADA historian. The backup system was also affected because it was connected to the same network. Management wants to ensure that the organization can recover from future incidents without paying the ransom. What should be implemented first?

   • ADisconnect the backup system from the network and implement offline, immutable backups with regular testing of restoration procedures.
   • BReimage all systems from the vendor's recovery media and reconfigure the network from scratch.
   • CRestore the systems from the existing backups and hope the ransomware does not reappear.
   • DPay the ransom to obtain the decryption key and then improve security.
   Reveal Solution Discussion Select an answer first