Vulnerability Scanners ICSSCADA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A vulnerability scan of a hospital's building management system (BMS) reported a critical vulnerability in a HVAC controller. The controller is running a firmware version that is no longer supported. The hospital cannot replace the controller immediately. What should the security team do to reduce the risk?

   • ASegment the HVAC controller network from the rest of the network and restrict access to it.
   • BIgnore the vulnerability because the controller is not internet-facing.
   • CIncrease the scan frequency to monitor the controller more closely.
   • DDisable the controller's network interface to prevent attacks.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team at a food processing company has integrated its vulnerability scanner with a ticketing system. After a scan, the team wants to ensure that each identified vulnerability is tracked through remediation. Which practice best supports this workflow?

   • ACreate tickets only for vulnerabilities that have a known exploit and assign them to the OT engineering team.
   • BCreate tickets for all vulnerabilities, but prioritize and assign them based on asset criticality and the responsible team.
   • CAutomatically create a ticket for every vulnerability and assign it to the IT helpdesk.
   • DExport the scan results to a spreadsheet and review them manually each month.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A vulnerability scan report shows a vulnerability in a safety instrumented system (SIS) controller. The SIS is critical for plant safety. What is the most appropriate action?

   • ADisconnect the SIS from the network until the patch is applied
   • BIgnore the finding because the SIS is isolated
   • CImmediately apply the vendor patch without testing
   • DTreat it as a high-priority finding and coordinate with the vendor for a patch plan
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security analyst is configuring a vulnerability scanner for a petrochemical plant's OT network. The plant has a mix of Windows-based HMIs and legacy PLCs. The analyst must minimize false positives while also ensuring that critical vulnerabilities are not missed. The scanner currently reports many false positives on the HMIs because it does not recognize vendor-specific security updates. What should the analyst do?

   • AIncrease the scan frequency to catch the updates more quickly.
   • BExclude the HMIs from the scan to avoid false positives.
   • CCreate custom detection rules for the vendor-specific updates and apply them to the HMI scan policy.
   • DSwitch to a passive scanner for the HMIs to reduce false positives.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A power generation company wants to assess the security of its substation automation network, which uses IEC 61850 protocols. The network is highly available and cannot tolerate any downtime. The security team is considering using a vulnerability scanner. Which approach is most appropriate?

   • ADeploy an agent on each substation device to collect vulnerability data.
   • BRun an active scan with a high number of concurrent connections to complete the scan quickly.
   • CPerform an active scan during a brief maintenance window even though the network is highly available.
   • DUse a passive scanner that monitors the IEC 61850 traffic without injecting packets.
   Reveal Solution Discussion Select an answer first