Selecting and Applying Controls to Mitigate Risk ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A pharmaceutical plant has a policy that operators should only be able to start and stop batch processes, while engineers can modify recipes and access the programming environment. Which access control mechanism should be implemented?

   • AConfigure role-based access control (RBAC) on the HMI and engineering workstations, assigning operators and engineers to different roles with appropriate permissions.
   • BUse a single shared account for all operators and engineers to simplify management.
   • CImplement a mandatory access control (MAC) system based on security labels for all users.
   • DAllow operators to access the programming environment but require them to log all changes.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A nuclear power plant has a comprehensive incident response plan, but it has never been tested. The plant is required to demonstrate that it can recover from a cyber incident within a specific time frame. What is the most effective way to validate the plan?

   • AConduct a tabletop exercise with key stakeholders to walk through the plan and identify gaps.
   • BWait for a real incident to test the plan.
   • CReview the plan annually without testing it.
   • DPerform a full-scale simulation that shuts down the plant.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A large petrochemical company is designing a new control network for a refinery. The design must balance the need for high availability with security. The safety system must be isolated from the business network, but the operations team needs real-time data for reporting. The security team wants to implement defense-in-depth without introducing excessive latency. Which architecture best meets these requirements?

   • AConnect the business network directly to the control network with a Layer 2 switch to minimize latency.
   • BImplement a VPN tunnel between the business and control networks for all traffic.
   • CPlace a firewall between the business network and the control network, and use a read-only data historian in a DMZ to provide data to the business network.
   • DUse a single firewall to separate the safety system from the rest of the control network.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the PRIMARY goal of incident response in an ICS environment?

   • ATo prevent all future incidents from occurring
   • BTo identify the attacker and prosecute them
   • CTo contain the incident, eradicate the threat, and restore normal operations
   • DTo collect evidence for legal proceedings
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A pharmaceutical plant has a policy that only authorized engineers can modify the PLC logic, and all changes must be logged. The plant uses a shared engineering workstation that is accessed by multiple engineers. Which combination of controls best enforces this policy?

   • AAllow all engineers to have full access to the PLCs but require them to sign a logbook after each change.
   • BUse a shared account for all engineers and rely on the PLC's internal change log.
   • CImplement individual user accounts with role-based access control on the engineering workstation, and enable audit logging for all PLC programming activities.
   • DDisable the engineering workstation's network access and require engineers to use a direct serial connection to the PLC.
   Reveal Solution Discussion Select an answer first