ICS Program & Policy Development GICSP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A pharmaceutical company is implementing a new ICS security policy that requires all changes to the production line control system to be logged and reviewed. The training department is developing a program for operators and engineers. What is the most important training objective to support this policy?

   • ADemonstrate how to bypass the logging system in case of emergency
   • BTeach staff how to properly log changes and understand the review process
   • CProvide an overview of the company's IT help desk ticketing system
   • DExplain the history of industrial automation and its evolution
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In the context of ICS security policy development, what is the purpose of a risk assessment?

   • ATo document all security incidents that have occurred in the past
   • BTo guarantee that all security risks are eliminated
   • CTo identify and evaluate threats, vulnerabilities, and potential impacts on the control system
   • DTo assign blame for security breaches to specific employees
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Who is ultimately accountable for the overall success of the ICS security program?

   • AThe plant manager
   • BThe ICS vendor
   • CThe IT security team
   • DSenior management or the board of directors
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary goal of an ICS security awareness program?

   • ATo replace the need for technical security controls
   • BTo provide advanced technical training for cybersecurity professionals
   • CTo ensure that all employees understand the security policies and their role in protecting the ICS
   • DTo satisfy regulatory requirements without any practical benefit
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A water utility's ICS security program was developed five years ago. Since then, the utility has added new treatment technologies and connected more systems to the corporate network. The program has not been updated, and a recent risk assessment identified new vulnerabilities. The utility is also facing a new state regulation that requires annual program reviews. Which action best supports continuous improvement while managing limited resources?

   • AReplace the entire program with a new framework to ensure it is current.
   • BPatch the newly identified vulnerabilities and defer the program review until the next regulatory inspection.
   • CFocus only on the new systems and ignore the legacy systems in the program update.
   • DConduct a comprehensive program review that updates the risk assessment, revises policies to reflect the new systems and threats, and establishes a recurring review cycle to meet the regulation.
   Reveal Solution Discussion Select an answer first