ICS Program & Policy Development GICSP Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A large automotive manufacturer is establishing an ICS security program. The program will cover multiple plants, each with its own OT engineers. The corporate security team wants to centralize all security decisions, but the plant managers want local control. Which role structure best balances central governance with local operational needs?

   • AA central ICS security committee sets standards and policies, while each plant has a local OT security liaison who adapts implementation to plant operations.
   • BThe plant managers are solely responsible for security, with no corporate involvement.
   • CThe corporate security team makes all decisions without plant input.
   • DEach plant operates independently with no central oversight.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A large chemical plant is developing a new ICS security policy that requires two-person integrity (TPI) for all remote configuration changes. The plant has a small OT team, and the policy may cause delays during shift changes. The plant manager is concerned about operational impact. What is the best way to balance security and operations?

   • ADelegate TPI approval to the shift operator on duty
   • BImplement TPI with a defined exception process for emergency changes, reviewed by the operations manager
   • CRequire TPI only for changes made during normal business hours, and allow single-person changes after hours
   • DAbandon TPI because it is too disruptive to the small team
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A power generation company is integrating risk management into its ICS security program. The company has a limited budget and must choose between two projects: upgrading the firewall on the OT network perimeter or implementing a security information and event management (SIEM) system for OT monitoring. The risk assessment shows that the most likely attack vector is external exploitation of the perimeter. Which project should the company prioritize?

   • AUpgrade the perimeter firewall because it directly mitigates the identified most likely attack vector
   • BSplit the budget equally between both projects to balance prevention and detection
   • CDefer both projects until the next budget cycle to gather more data
   • DImplement the SIEM system because it provides visibility into all attacks
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A refinery has implemented a policy that requires all OT personnel to complete annual security awareness training. The training department is unsure how to enforce completion. Which enforcement method is most effective?

   • ASend a monthly email to all employees with a link to the training
   • BPost a notice on the employee bulletin board reminding staff to complete the training
   • CIntegrate training completion into the performance review process and revoke OT access for non-completion
   • DAsk supervisors to verbally remind their teams during shift meetings
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A utility has an ICS security policy that prohibits the use of removable media on OT workstations. However, a field engineer regularly uses a USB drive to transfer configuration files to a remote substation. Which enforcement method is most effective in this situation?

   • ARely on the annual training to remind engineers of the policy.
   • BTechnically block USB ports on all OT workstations using endpoint controls.
   • CRevise the policy to allow USB drives without restrictions.
   • DTerminate the engineer for violating the policy.
   Reveal Solution Discussion Select an answer first