IC33 ISA-IEC 62443 Cybersecurity Risk Assessment Specialist v1.0
Question 1
Which organization provides information regarding common vulnerabilities in IACS?
- A. ICS-CERT
- B. ISO
- C. IEEE
- D. NIST
Answer : A
Question 2
Which parts of the ISA/IEC 62443 series do product suppliers use to understand requirements for control system components?
- A. ISA/IEC 62443-1-1 and ISA/IEC 62443-2-3
- B. ISA/IEC 62443-4-1 and ISA/IEC 62443-4-2
- C. ISA/IEC 62443-2-1 and ISA/IEC 62443-3-2
- D. ISA/IEC 62443-1-5 and ISA/IEC 62443-6-1
Answer : B
Question 3
Which statement describes a communication and network vulnerability?
- A. Inadequate firewall and router logs
- B. Lack of adequate access control policy
- C. No formal ICS security training program
- D. Inadequate review of ICS security controls
Answer : A
Question 4
What is one reason for conducting a walk-through during the risk assessment preparation?
- A. To enhance marketing strategies
- B. To ensure compliance with financial regulations
- C. To assess physical security
- D. To evaluate employee performance
Answer : C
Question 5
Which type of vulnerability assessment involves attempting to exploit unknown vulnerabilities?
- A. Metasploit
- B. Port scanning
- C. Vulnerability scanning
- D. Penetration testing
Answer : D
Question 6
What does impact measure in the context of consequences?
- A. The number of employees affected by an incident
- B. The ultimate loss or harm from the incident
- C. The financial profit from an incident
- D. The duration of the effect of an incident
Answer : B
Question 7
Refer to the zone and conduit diagram. Which would be a valid change to the zone and conduit diagram shown above?
- A. Move the Web server to the Internet.
- B. Move the data historian into a conduit.
- C. Move the safety instrumented system (SIS) into a separate zone.
- D. Move the common engineering workstation to the plant demilitarized zone.
Answer : C
Question 8
What should the system under consideration (SUC) be partitioned into to help facilitate a detailed cybersecurity risk assessment?
- A. Purdue levels
- B. Zones and conduits
- C. Areas and conductors
- D. Safety and Security Components
Answer : B
Question 9
Which is an important consideration for safety instrumented system (SIS) assets regarding zones and conduits?
- A. SIS assets should not have any conduits.
- B. SIS assets should be grouped with wireless systems.
- C. SIS assets should be placed in a demilitarized zone.
- D. SIS assets should be segregated from non-SIS assets.
Answer : D
Question 10
What is one approach to make a SUC resilient from the beginning?
- A. Short-term fixes
- B. Defense in depth
- C. Ignoring potential threats
- D. Reducing security measures
Answer : B
Question 11
How are consequence values determined?
- A. Based on market trends
- B. By company’s risk appetite
- C. Through employee surveys
- D. Randomly assigned
Answer : B
Question 12
The owner or operator of a plant should have at least which one of the following for analyzing industrial cybersecurity?
- A. Many incidents
- B. One or more SUC
- C. Critical vulnerabilities
- D. A critical infrastructure
Answer : B
Question 13
What is a Zone?
- A. A group of Cyber-Assets which perform specific functions for safety and security.
- B. A group of Cyber-Assets connected to at least one conduit or communications channel.
- C. A collection of Components surrounded by a communications channel forming a perimeter.
- D. A logical grouping of physical, informational, and application assets sharing common security requirements.
Answer : D
Question 14
Which type of analysis can be used to help identify potential consequences as part of an initial cybersecurity risk assessment?
- A. Cost-benefit analysis
- B. Failure mode analysis
- C. Process hazards analysis
- D. Vulnerability vector analysis
Answer : C
Question 15
In the AIC triad, what does "C" represent?
- A. Commonality
- B. Compliance
- C. Confidentiality
- D. Criticality
Answer : C