I85PREP
⌘ K
CSSA ICS/SCADA Security Architect preparation study materials
CSSA ICS/SCADA Security Architect preparation study resources

CSSA ICS/SCADA Security Architect preparation practice questions

One question at a time. Build your CSSA ICS/SCADA Security Architect preparation understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network boundaries and protected communication

In a simplified state-table model of a stateful firewall, what distinguishes handling of an established permitted session from a stateless packet filter?

  1. It forwards the packet only after re-running the access list against every header field
  2. It logs the packet and drops it unless a matching deny rule exists
  3. It discards the packet and requires a new three-way handshake for every segment
  4. It permits the packet without re-evaluating the full rule base for each packet Correct answer.

Explanation

A stateful firewall tracks sessions in a state table and, once a connection is established, allows return and subsequent traffic that matches that entry without re-evaluating the entire rule set per packet. This is the core efficiency and security advantage over stateless filtering.

Question 2Network boundaries and protected communication

A network engineer must allow only inbound HTTP and HTTPS to a public web server while blocking all other inbound traffic, without exposing internal hosts. Which placement of the server is most appropriate?

  1. In a DMZ segment separated from the internal network by the firewall Correct answer.
  2. On the same VLAN as the database servers
  3. On the internal LAN segment behind the core switch
  4. Directly on the internet-facing router interface with no filtering

Explanation

A DMZ isolates internet-facing services from the internal network so that compromise of the public server does not directly expose internal hosts. The firewall then controls traffic between the DMZ, the internet, and the internal LAN.

Question 3Network boundaries and protected communication

Which statement correctly distinguishes an IDS from an IPS in perimeter deployment?

  1. An IPS passively copies traffic for analysis while an IDS drops it
  2. Both devices are passive and differ only in the number of interfaces
  3. An IDS detects and alerts on suspicious traffic while an IPS can drop it inline Correct answer.
  4. An IDS blocks malicious traffic inline while an IPS only logs it

Explanation

An intrusion detection system monitors traffic and generates alerts but does not sit inline to block it, whereas an intrusion prevention system is deployed inline and can actively drop or reset malicious traffic. The distinction is detection-and-alert versus inline prevention.

Question 4Network boundaries and protected communication

A perimeter ACL is intended to permit management access to network devices only from the operations subnet. Which rule ordering practice prevents the ACL from being bypassed by broader permits?

  1. Rely on the implicit deny at the end to enforce the specific permit
  2. Sort rules alphabetically by source address
  3. Place the specific permit after the default permit-any rule
  4. Place the specific permit for the operations subnet before any broad permit rules Correct answer.

Explanation

ACLs are evaluated top-down and the first matching rule wins, so specific permits must precede broader permits that would otherwise match the same traffic. The implicit deny at the end only affects traffic that matches no rule.

Question 5Network boundaries and protected communication

Which protocol and port combination should a perimeter rule permit for secure remote administration of a firewall appliance itself?

  1. HTTP on TCP 80
  2. Telnet on TCP 23
  3. SSH on TCP 22 Correct answer.
  4. TFTP on UDP 69

Explanation

SSH on TCP 22 provides encrypted, authenticated remote administration and is the standard secure choice for device management. Telnet, TFTP, and plain HTTP transmit credentials and configuration data in cleartext.

Question 6Identity, access and cryptographic protection

Which Cisco product provides the multi-factor authentication, device trust, and risk-based access decisions called out in the SCAZT identity domain?

  1. Cisco Umbrella
  2. Cisco Duo Correct answer.
  3. Cisco ISE
  4. Cisco Secure Endpoint

Explanation

Cisco Duo is Cisco's identity security platform: it delivers multi-factor authentication, single sign-on, passwordless, Trusted Endpoints (device trust), and Risk-Based Authentication that adjusts MFA requirements based on contextual signals. Umbrella is a SIG/DNS layer, ISE focuses on on-prem network access control, and Secure Endpoint is an EDR product.

Question 7Identity, access and cryptographic protection

Which Duo authentication factor is considered phishing-resistant and aligned with NIST SP 800-63B AAL3 cryptographic authenticator requirements?

  1. Duo Push notification
  2. Duo SMS passcodes
  3. Duo Verified Push (number matching)
  4. Duo with WebAuthn / FIDO2 security keys Correct answer.

Explanation

WebAuthn / FIDO2 security keys (including platform authenticators like Windows Hello and Touch ID) are phishing-resistant because the credential is bound to the relying-party origin and a private key never leaves the authenticator. SMS is explicitly discouraged by NIST 800-63B; standard Duo Push and Verified Push add usability and friction respectively but remain phishable to AiTM under sophisticated attacks. WebAuthn satisfies AAL3 cryptographic authenticator requirements when paired with a hardware authenticator.

Question 8Identity, access and cryptographic protection

An administrator wants to ensure that only corporate-managed laptops can complete a Duo MFA flow for a SaaS application. Which Duo capability enforces this?

  1. Duo Network Gateway
  2. Duo Trusted Endpoints Correct answer.
  3. Duo Single Sign-On
  4. Duo Mobile

Explanation

Duo Trusted Endpoints distinguishes managed (trusted) devices from unmanaged ones using device certificates issued by an MDM, Active Directory domain trust, or Jamf Pro for macOS. A policy can then block or step up authentication for unmanaged endpoints. Duo SSO and Duo Mobile do not assess device management state; Duo Network Gateway is a clientless gateway for on-prem web/SSH apps.

Question 9Identity, access and cryptographic protection

When integrating Cisco Duo with Microsoft Entra ID (Azure AD) so that Duo provides MFA for federated apps, which protocol commonly carries the SAML assertion from Duo back to the relying-party application?

  1. RADIUS
  2. LDAP
  3. SAML 2.0 Correct answer.
  4. OAuth 1.0

Explanation

Duo SSO acts as a SAML 2.0 Identity Provider for relying-party applications: after primary authentication and Duo MFA, Duo issues a SAML 2.0 assertion to the application via HTTP-POST or HTTP-Redirect binding. RADIUS and LDAP are used by Duo's network device integrations, not for federated SaaS SSO. OAuth 1.0 is obsolete and not used here; modern API delegation uses OAuth 2.0 / OIDC.

Question 10Identity, access and cryptographic protection

Which protocol does Cisco Duo SSO use to automatically provision and deprovision user accounts in downstream SaaS applications based on changes in the upstream identity provider?

  1. LDAP
  2. SCIM 2.0 Correct answer.
  3. RADIUS CoA
  4. TACACS+

Explanation

SCIM 2.0 (System for Cross-domain Identity Management) is the open standard for automated user provisioning and deprovisioning. Duo SSO supports SCIM as both a source (to receive directory changes) and a target (to push lifecycle events to downstream apps). LDAP is a directory protocol but not a lifecycle automation standard; RADIUS CoA changes session state, not user lifecycle; TACACS+ is for device admin AAA.

Question 11Cyber-risk identification and analysis

The amount and type of risk an organization is willing to accept in pursuit of its objectives is known as:

  1. Residual risk
  2. Risk tolerance
  3. Risk appetite Correct answer.
  4. Risk capacity

Explanation

Risk appetite is the level and type of risk senior management chooses to pursue because of the value it expects in return. Capacity is the maximum risk the organization could bear, while tolerance is the acceptable deviation around appetite.

Question 12Cyber-risk identification and analysis

The risk that remains after risk responses and controls have been applied is called:

  1. Control risk
  2. Inherent risk
  3. Residual risk Correct answer.
  4. Detection risk

Explanation

Inherent risk is the exposure before any response, and residual risk is what is left once controls and other responses are operating. Risk reporting and comparison against appetite are normally based on residual risk.

Question 13Cyber-risk identification and analysis

Which tool is used to record identified risks together with their owners, ratings, and response status?

  1. Risk appetite statement
  2. Risk register Correct answer.
  3. Control self-assessment
  4. Issue log

Explanation

The risk register is the central inventory of identified risks with attributes such as owner, likelihood, impact, response, and status. It supports monitoring, escalation, and aggregation for enterprise reporting.

Question 14Cyber-risk identification and analysis

Annualized loss expectancy (ALE) is calculated as (SLE = single loss expectancy; ARO = annualized rate of occurrence):

  1. ARO divided by SLE
  2. SLE multiplied by ARO Correct answer.
  3. Asset value multiplied by exposure factor
  4. SLE divided by ARO

Explanation

SLE is the loss from one event and ARO is the expected number of such events per year, so their product gives the expected annual loss. Asset value times exposure factor produces SLE, not ALE.

Question 15Cyber-risk identification and analysis

A weakness in a process, system, or control that a threat could exploit is called a:

  1. Vulnerability Correct answer.
  2. Threat event
  3. Loss event
  4. Risk factor

Explanation

Risk arises where a threat can exploit a vulnerability and produce an impact on an asset. The vulnerability is the weakness itself, not the actor or the resulting loss.

Question 16Continuity, backup and technical recovery

An organization defines a recovery time objective (RTO) of four hours for its order-entry system. Which statement best describes what this RTO represents?

  1. The maximum age of backup data that may be restored without unacceptable loss
  2. The time window during which the disaster recovery plan must be formally reviewed
  3. The interval between scheduled full and incremental backup cycles
  4. The maximum acceptable elapsed time to restore the order-entry service after a disruption Correct answer.

Explanation

The stated four-hour recovery time objective is the target interval for restoring the defined service under the scenario assumptions. It is distinct from RPO, which addresses the acceptable recovery point and potential data loss; a target is not proof that the tested architecture achieves it.

Question 17Continuity, backup and technical recovery

A security operations team must classify a backup that is written once to immutable storage and retained for seven years to satisfy a regulatory obligation. Which backup type is this?

  1. Continuous data protection
  2. Snapshot backup
  3. Archive backup Correct answer.
  4. Differential backup

Explanation

An archive backup is a long-term retained copy kept for legal, regulatory, or historical purposes rather than for routine operational restore. Immutability and multi-year retention are typical archive characteristics. Operational backup types such as differential or snapshot serve near-term recovery instead.

Question 18Continuity, backup and technical recovery

Which statement correctly distinguishes a disaster recovery plan from a business continuity plan?

  1. The DR plan covers only cybersecurity incidents, while the BC plan covers natural disasters
  2. The DR plan replaces the BC plan once systems are fully virtualized
  3. The DR plan is owned by the finance department, while the BC plan is owned by IT operations
  4. The DR plan focuses on restoring IT infrastructure and services, while the BC plan addresses continuation of critical business functions overall Correct answer.

Explanation

Disaster recovery is the technology-focused subset of continuity that restores infrastructure, data, and applications after a major disruption. Business continuity is broader, covering people, processes, facilities, and communications needed to keep critical functions running. The two are complementary and neither replaces the other.

Question 19Continuity, backup and technical recovery

A business impact analysis identifies a payment service as critical with an RTO of two hours, but the current tested restore time is nine hours. What is the most appropriate next action for the security operations team?

  1. Accept the result because the service has never failed in production
  2. Remove the payment service from the critical systems inventory
  3. Lower the RTO to nine hours so the test result matches the objective
  4. Record the gap and drive remediation such as improved replication or standby capacity to meet the RTO Correct answer.

Explanation

The BIA-derived RTO expresses business tolerance, so a tested restore time that exceeds it is a documented recovery gap requiring remediation. Options that change the objective to fit current capability hide the risk rather than manage it. The gap should be tracked with owners and target dates.

Question 20Continuity, backup and technical recovery

A team keeps nightly full backups plus hourly transaction-log backups. A failure destroys the primary database at10:40; the latest recoverable log point is10:00. What is the potential transaction-loss window in this event?

  1. Approximately 24 hours of potential data loss
  2. Approximately 60 minutes of potential data loss
  3. Approximately 40 minutes of potential data loss Correct answer.
  4. No data loss, because logs are backed up hourly

Explanation

The last recoverable point is10:00 and failure occurs at10:40, so the observed potential loss window is40minutes. That is the achieved point in this event, not proof that a40minute objective is met at every possible failure time. Backup completion, replay and recoverability must be verified.

Question 21OT process context, trust boundaries and controlled connectivity

Which of the following best describes an Industrial Control System (ICS)?

  1. A collection of systems used to monitor and control industrial processes such as manufacturing, energy distribution, and water treatment Correct answer.
  2. A system that manages financial transactions in enterprise environments
  3. A network of servers used to host web applications for critical infrastructure
  4. A cloud-based platform for managing enterprise resource planning

Explanation

An ICS is a broad category of systems used to monitor, control, and automate industrial processes. ICS includes SCADA, DCS, and PLC-based systems that operate critical infrastructure such as power grids, water treatment, oil and gas, and manufacturing. These systems have unique safety and availability requirements that differentiate them from enterprise IT.

Question 22OT process context, trust boundaries and controlled connectivity

What is the primary difference between Operational Technology (OT) and Information Technology (IT)?

  1. OT directly monitors and controls physical processes, whereas IT processes and transmits data Correct answer.
  2. OT systems run on Linux while IT systems run on Windows
  3. OT uses the TCP/IP protocol stack exclusively, while IT uses proprietary protocols
  4. OT is only used in military environments, while IT is used in commercial settings

Explanation

OT encompasses hardware and software that directly monitors and controls physical devices, processes, and events in industrial environments. IT focuses on data processing, storage, and communication. This distinction is fundamental to OT security because OT failures can have physical consequences - including equipment damage, environmental harm, or loss of life - that IT failures typically do not.

Question 23OT process context, trust boundaries and controlled connectivity

Which component of an ICS directly reads sensors and actuates field devices in a SCADA system?

  1. Historian server
  2. Human-Machine Interface (HMI)
  3. Remote Terminal Unit (RTU) or Programmable Logic Controller (PLC) Correct answer.
  4. Engineering workstation

Explanation

RTUs and PLCs are field devices that interface directly with physical sensors (inputs) and actuators (outputs) such as valves, motors, and relays. They execute control logic and report real-time data to the SCADA master station. PLCs are typically used in discrete manufacturing while RTUs are common in geographically distributed systems like pipelines and power grids.

Question 24OT process context, trust boundaries and controlled connectivity

What is a Distributed Control System (DCS) most commonly used for?

  1. Controlling continuous industrial processes such as chemical refining and power generation within a single plant Correct answer.
  2. Monitoring and managing widely geographically dispersed field devices over long distances
  3. Providing remote access to SCADA systems from enterprise networks
  4. Storing and analyzing historical process data for compliance reporting

Explanation

A DCS is designed to control continuous process operations within a plant or facility, such as chemical processing, oil refining, or power generation. DCS controllers are distributed throughout the plant and communicate over a dedicated control network. Unlike SCADA, which monitors geographically dispersed assets, DCS focuses on tight, real-time control of a localized continuous process.

Question 25OT process context, trust boundaries and controlled connectivity

What is the primary reason that SCADA 'security by obscurity' (relying on proprietary protocols or unpublished interfaces as a security measure) is considered insufficient?

  1. Obscurity always fails because ICS vendors publish full protocol documentation on public websites
  2. Security by obscurity is an accepted and effective compensating control under IEC 62443 when other controls are not feasible
  3. Obscurity provides no real security because ICS protocols and device internals can be reverse-engineered, protocol documents leak over time, and attackers with ICS-specific expertise are increasingly common - it should not substitute for real security controls Correct answer.
  4. Obscurity fails only when the ICS system is connected to the internet

Explanation

Security by obscurity assumes that keeping a system's design secret provides protection. In ICS/OT, this fails because: (1) attackers reverse-engineer protocols (many 'proprietary' ICS protocols are now publicly documented); (2) vendors' documentation leaks; (3) APT groups invest significant resources in ICS protocol research; (4) obscurity provides no protection when insider threats or vendor access is compromised. IEC 62443 and NIST SP 800-82 explicitly state that security cannot rely on obscurity alone.

Question 26OT process context, trust boundaries and controlled connectivity

What is 'ladder logic' and why is unauthorized modification of ladder logic a critical ICS security concern?

  1. Ladder logic is the physical wiring diagram of an ICS control panel; unauthorized modification would require physical access only
  2. Ladder logic is a network routing algorithm used to establish SCADA communication paths between RTUs
  3. Ladder logic is the programming language used to configure PLC control logic; unauthorized modification can alter how the PLC controls physical processes, potentially causing equipment damage, process disruption, or safety hazards Correct answer.
  4. Ladder logic is the encryption protocol used to secure PLC programming software connections

Explanation

Ladder logic is a graphical programming language derived from relay logic diagrams, used to program PLCs. Each 'rung' of the ladder represents an input condition and output action. Unauthorized modification of ladder logic - whether through network compromise of an engineering workstation, unauthorized PLC programming port access, or firmware manipulation - can silently change how the PLC controls valves, motors, or safety systems, leading to dangerous or destructive process behavior that may not be immediately apparent to operators.

Question 27OT process context, trust boundaries and controlled connectivity

What does 'OT-IT convergence' mean in the context of ICS security, and what new risks does it introduce?

  1. OT-IT convergence means migrating all industrial processes to cloud-based IT systems
  2. OT-IT convergence means adopting IT security policies for OT systems without modification
  3. OT-IT convergence refers to the increasing integration of traditionally separate OT/ICS networks with enterprise IT networks - introducing IT-originated threats (ransomware, phishing-delivered malware) into OT environments that were previously isolated Correct answer.
  4. OT-IT convergence is the merging of OT and IT vendor organizations through corporate mergers and acquisitions

Explanation

OT-IT convergence describes the trend of connecting ICS/OT networks to enterprise IT networks for data analytics, remote monitoring, and operational efficiency. This exposes OT networks to IT-originated threats: ransomware that pivots from IT to OT (as seen in the Colonial Pipeline attack, where business system ransomware caused precautionary OT shutdown), phishing-delivered malware, and commodity malware that spreads via SMB. Organizations must implement proper boundary controls and OT-specific security monitoring at the convergence point.

Question 28OT process context, trust boundaries and controlled connectivity

In the Purdue Model, at which level would you find PLCs and RTUs performing basic automatic control of field devices?

  1. Level 1 Correct answer.
  2. Level 0
  3. Level 2
  4. Level 3

Explanation

Level 1 (Basic Control) contains PLCs, RTUs, and other embedded controllers that execute control logic and communicate directly with field devices at Level 0. Level 0 contains the physical sensors and actuators themselves. Level 2 contains HMIs and supervisory SCADA software. Level 3 is manufacturing operations management.

Question 29OT process context, trust boundaries and controlled connectivity

What security concept does the modern ICS-DMZ (Industrial DMZ) implement between the control network and the enterprise network in the Purdue Model?

  1. It creates a buffered zone that mediates data flows between the enterprise (Level 4/5) and industrial (Level 3) networks without direct connectivity Correct answer.
  2. It provides a shared flat network segment for OT and IT data exchange
  3. It replaces the need for firewalls by providing a dedicated data link layer bridge
  4. It hosts PLCs and RTUs in a virtualized environment accessible from both networks

Explanation

An ICS-DMZ (often between Levels 3 and 4/5) acts as an intermediary zone that allows data to flow between the enterprise and operational networks without establishing direct routed paths. Servers in the DMZ (data historians, file transfer proxies) mediate the exchange, limiting lateral movement risk. This implements defense-in-depth by ensuring no direct route from enterprise to control networks.

Question 30OT process context, trust boundaries and controlled connectivity

Which ICS/OT architecture concept is most closely aligned with the principle of 'defense-in-depth'?

  1. Deploying multiple layered security controls including network segmentation, monitoring, physical security, and access controls Correct answer.
  2. Using a single firewall at the enterprise network boundary to protect all OT systems
  3. Encrypting all SCADA communications using TLS 1.3
  4. Requiring two-factor authentication only for remote access to the HMI

Explanation

Defense-in-depth in ICS/OT means layering multiple independent security controls so that the compromise of one control does not lead to a complete system breach. This includes network segmentation (zones and conduits per IEC 62443), physical security, endpoint hardening, monitoring, and access controls. No single control is relied upon exclusively.

Question 31OT process context, trust boundaries and controlled connectivity

What does the concept of 'air gap' mean in the context of ICS/OT security, and what is a significant limitation?

  1. Air gap means the OT network has no physical network connection to external networks; the limitation is that data exchange still occurs via removable media, USB devices, or compromised supply chain, which can introduce malware Correct answer.
  2. Air gap means all OT devices are wirelessly connected; the limitation is radio interference
  3. Air gap means OT firewalls block all inbound traffic; the limitation is that outbound traffic remains unfiltered
  4. Air gap is an encryption standard for ICS communications; its limitation is computational overhead on PLCs

Explanation

An air gap physically isolates the OT network from external networks including the internet and enterprise IT. However, data must still flow in and out via USB drives, laptops, vendor maintenance laptops, and supply-chain firmware updates - all of which are common attack vectors. Stuxnet is the canonical example of malware crossing an air gap via infected USB media.

Question 32OT process context, trust boundaries and controlled connectivity

IEC 62443 is an international standard series addressing security for which type of systems?

  1. Industrial Automation and Control Systems (IACS) Correct answer.
  2. Financial trading systems and stock exchange infrastructure
  3. Internet of Things consumer devices
  4. Electric vehicle charging networks

Explanation

IEC 62443 is a comprehensive series of standards developed by ISA (ISA/IEC 62443) that addresses security for Industrial Automation and Control Systems (IACS). It provides requirements for product developers, system integrators, and asset owners, and defines Security Levels (SL 1–4) and Security Zones/Conduits for risk-based implementation.

Question 33OT process context, trust boundaries and controlled connectivity

In the IEC 62443 standard, what do 'Security Levels' (SL 1–4) represent?

  1. The robustness of security controls required to resist attackers with increasing capability and motivation Correct answer.
  2. The number of firewalls required between ICS zones
  3. The encryption key lengths required for different ICS communication channels
  4. The number of days allowed to patch vulnerabilities in ICS components

Explanation

IEC 62443 Security Levels (SL 1–4) define the capability of an attacker that the controls must resist. SL 1 protects against casual/unintentional violation; SL 2 against intentional violation using simple means; SL 3 against sophisticated attacks using ICS-specific skills; SL 4 against state-sponsored or nation-state actors. Asset owners select target SLs based on risk assessment.

Question 34OT process context, trust boundaries and controlled connectivity

Which listed NIST publication series provides guidance specifically for operational-technology security, including industrial control systems?

  1. Industrial Control System (ICS) security Correct answer.
  2. Federal enterprise IT security and cloud computing
  3. Healthcare information systems and HIPAA compliance
  4. Software development lifecycle security

Explanation

NIST SP 800-82 'Guide to Industrial Control System (ICS) Security' is the primary NIST publication addressing security for SCADA, DCS, PLC, and other ICS environments. It provides guidance on applying NIST SP 800-53 security controls to ICS while accounting for the unique operational constraints and availability requirements of industrial systems.

Question 35OT process context, trust boundaries and controlled connectivity

DNP3 (Distributed Network Protocol 3) is most commonly used in which critical infrastructure sector?

  1. Electric utilities and water/wastewater systems for reliable SCADA communications Correct answer.
  2. Healthcare and hospital management systems
  3. Financial services for high-frequency trading systems
  4. Transportation logistics and fleet management

Explanation

DNP3 is a widely used protocol in electric utilities, water, and wastewater SCADA systems. It was designed for reliable communication between master stations and RTUs over unreliable communication links, supporting data integrity, time stamping, and event-driven reporting. DNP3 Secure Authentication (SA) v5 was added to address its original lack of security features.

Question 36OT process context, trust boundaries and controlled connectivity

Which of the following describes a key architectural security recommendation in IEC 62443 for managing data flow between ICS security zones?

  1. Use conduits with appropriate security controls to manage communication between zones, applying the principle of least privilege to allowed flows Correct answer.
  2. Connect all zones to a common VLAN to simplify management
  3. Permit all traffic within Levels 0–3 of the Purdue Model to improve operational efficiency
  4. Replace all proprietary ICS protocols with standard HTTP/HTTPS for compatibility

Explanation

IEC 62443 defines 'Zones' (groups of assets with similar security requirements) and 'Conduits' (the communication paths between zones). Conduits must be explicitly defined, and all traffic through them should be controlled using the principle of least privilege - allowing only necessary communication. This limits lateral movement if one zone is compromised.

Question 37OT process context, trust boundaries and controlled connectivity

What is OPC (OLE for Process Control) and what are the key security considerations for OPC communications in ICS environments?

  1. OPC is an ICS firewall standard; its security risk is improper rule configuration
  2. OPC is a middleware standard for data exchange between ICS components; legacy OPC Classic uses DCOM which requires many open firewall ports and is difficult to secure, whereas OPC-UA uses a single configurable port with built-in security Correct answer.
  3. OPC is a physical cabling standard for connecting PLCs to HMIs; its security risk is counterfeit cabling
  4. OPC is a network routing protocol used in ICS; its security risk is route injection attacks

Explanation

OPC (now branded OPC Foundation) is a widely-used middleware enabling interoperability between different ICS components and vendors. OPC Classic (DA, HDA, A&E) uses Microsoft's DCOM, which dynamically allocates high port numbers (1024–65535), making firewall policies nearly impossible to restrict effectively. OPC Unified Architecture (OPC-UA) was specifically designed to address these security problems: it uses a single configurable TCP port, supports TLS encryption, and has built-in authentication and authorization.

Question 38OT process context, trust boundaries and controlled connectivity

Which standard specifically defines functional safety requirements for Safety Instrumented Systems (SIS) in process industries, and how does it relate to ICS cybersecurity?

  1. ISO 27001 - defines information security management for SIS environments
  2. NERC CIP-005 - defines electronic perimeter requirements for SIS in electric utilities
  3. IEC 61511 (Functional Safety - Safety Instrumented Systems for the Process Industry) - defines SIL requirements for SIS design; cybersecurity (cyber-induced common-cause failures) must be assessed as part of SIS hazard analysis Correct answer.
  4. IEEE 802.3 - defines Ethernet standards used in SIS network communications

Explanation

IEC 61511 is the process industry standard (companion to IEC 61508) governing Safety Instrumented Systems design. IEC 61511-1 Edition 2 (2016) explicitly requires that cybersecurity threats be considered as part of the hazard and risk analysis for SIS. Cyber-induced failures (e.g., TRITON-style attacks) are recognized as 'common cause failures' that can defeat independent safety layers. This bridges the gap between functional safety engineering and cybersecurity - a critical connection for SCADA security architects.

Question 39OT process context, trust boundaries and controlled connectivity

What is 'secure by design' as applied to ICS product development under IEC 62443-4-1, and what does it require of ICS product vendors?

  1. Secure by design means ICS products must be physically robust against environmental damage
  2. Secure by design means ICS products must ship with all security features enabled by default, requiring no post-installation configuration
  3. Secure by design under IEC 62443-4-1 only applies to safety-critical ICS components, not general SCADA software
  4. IEC 62443-4-1 requires ICS product vendors to follow a defined secure development lifecycle (SDL) that includes security requirements, threat modeling, secure design review, vulnerability testing, and documented patching processes - building security in from the design phase rather than patching it later Correct answer.

Explanation

IEC 62443-4-1 (Product Security Development Life-Cycle Requirements) defines security requirements for ICS product vendors to embed security throughout development: (1) security requirements at design time; (2) threat modeling for each component; (3) design reviews for security; (4) security testing including fuzzing and vulnerability scanning; (5) a documented patch/vulnerability disclosure process. This 'shift left' approach means vulnerabilities are identified and addressed before products ship, reducing the patching burden on asset owners.

Question 40OT process context, trust boundaries and controlled connectivity

In the context of the CSSA exam and IEC 62443, what is a 'target security level' (SL-T) versus 'achieved security level' (SL-A), and why does the gap between them matter?

  1. SL-T is the maximum security level possible with current technology; SL-A is the minimum acceptable level
  2. SL-T and SL-A are both defined by the ICS vendor and cannot be changed by the asset owner
  3. SL-T is the theoretical security level during a cyber attack; SL-A is the pre-attack baseline
  4. SL-T is the security level the asset owner determines is required based on risk assessment; SL-A is the security level actually implemented - the gap between SL-T and SL-A represents residual risk that requires compensating controls or planned remediation Correct answer.

Explanation

In IEC 62443, the Target Security Level (SL-T) is determined by the asset owner through a risk assessment - it represents the security robustness required to adequately protect against the identified threats. The Achieved Security Level (SL-A) is the level actually implemented by current controls. The gap between SL-T and SL-A is a security risk that must be managed: either implement additional controls to close the gap, accept the risk with documented justification, or apply compensating controls. This gap analysis drives security investment prioritization.

Question 41OT monitoring, change control, response and recovery

Which threat category describes attacks where an adversary manipulates SCADA process data - such as falsifying sensor readings sent to an HMI - to cause operators to make incorrect control decisions?

  1. False Data Injection (FDI) or Integrity Attack Correct answer.
  2. Denial of Service (DoS)
  3. Man-in-the-Middle (MitM) for eavesdropping only
  4. Advanced Persistent Threat (APT) lateral movement

Explanation

False Data Injection (FDI) attacks target the integrity of process data. By manipulating sensor readings or control signals, an attacker can cause operators to believe the process is operating normally while actually it is in a dangerous state, or vice versa. This attack is particularly dangerous in ICS because it exploits operator trust in instrumentation data, potentially causing delayed response to real physical hazards.

Question 42OT monitoring, change control, response and recovery

The TRITON/TRISIS malware (discovered 2017) specifically targeted which type of ICS safety system?

  1. Safety Instrumented Systems (SIS), specifically Schneider Electric Triconex Safety Instrumented Systems Correct answer.
  2. Modbus RTU master stations at wastewater treatment plants
  3. DNP3 communication servers in electric utility substations
  4. Historian servers in oil and gas pipeline SCADA environments

Explanation

TRITON/TRISIS was designed to attack Safety Instrumented Systems (SIS) - the last line of defense that triggers an emergency shutdown to prevent catastrophic equipment failure. By targeting Schneider Electric Triconex SIS controllers, the attackers sought to disable safety systems so that a subsequent process disruption attack could cause physical damage or casualties without a safe shutdown intervening.

Question 43OT monitoring, change control, response and recovery

Which attack technique involves an adversary monitoring ICS network traffic to learn normal process values and communication patterns before launching an attack?

  1. Passive reconnaissance / network traffic analysis Correct answer.
  2. Fuzzing
  3. Privilege escalation
  4. Spear-phishing

Explanation

Passive reconnaissance in ICS involves capturing and analyzing network traffic to map device addressing, identify protocol types, determine normal operating ranges (setpoints), and understand communication timing. This reconnaissance enables the attacker to craft targeted commands or false data that appear legitimate. Because ICS protocols like Modbus and DNP3 are typically unencrypted, passive sniffing is particularly effective.

Question 44OT monitoring, change control, response and recovery

What makes ICS/OT environments particularly vulnerable to legacy system exploitation compared to enterprise IT environments?

  1. ICS/OT devices often run outdated operating systems and firmware that cannot be patched without operational disruption, creating long windows of exposure Correct answer.
  2. ICS devices always run on public cloud infrastructure, exposing them to internet threats
  3. ICS networks use exclusively wireless communications, which are inherently insecure
  4. ICS devices are required by law to maintain open network access for government audits

Explanation

Many ICS components run embedded operating systems (e.g., Windows XP, Windows CE, custom RTOS) that have reached end-of-life but cannot be patched or replaced without halting production, affecting uptime commitments, or voiding vendor warranties. Combined with 20–30 year operational lifespans for some ICS equipment, this creates extended vulnerability windows that are rare in enterprise IT.

Question 45OT monitoring, change control, response and recovery

Which specific ICS protocol attack involves sending unsolicited Modbus 'Force Single Coil' (function code 05) or 'Write Single Register' (function code 06) commands to alter PLC outputs?

  1. DNP3 spoofing
  2. EtherNet/IP session hijacking
  3. Unauthorized Modbus write command injection Correct answer.
  4. PROFIBUS man-in-the-middle

Explanation

Because Modbus has no authentication, any device on the network can send write commands (FC 05 Force Single Coil, FC 06 Write Single Register, FC 15/16 for multiple coils/registers) directly to a PLC's output registers or coils. An attacker who can reach a Modbus slave can issue these commands to force actuators on or off, change setpoints, or overwrite configuration registers. Detecting these attacks requires protocol-aware monitoring that distinguishes legitimate write sources from unauthorized ones.

Question 46OT monitoring, change control, response and recovery

Which wireless protocol used in some ICS environments is considered most vulnerable due to its use of WEP-derived encryption and short key lengths?

  1. WirelessHART - it uses WPA2-Enterprise and is generally considered secure
  2. Bluetooth Low Energy (BLE) - it requires physical proximity and has inherently strong encryption
  3. IEEE 802.11 Wi-Fi with WEP encryption - WEP uses RC4 with static 40/104-bit keys that can be cracked in minutes Correct answer.
  4. Zigbee with AES-128 - it has strong encryption and is widely considered secure for ICS sensors

Explanation

WEP (Wired Equivalent Privacy) on IEEE 802.11 networks is cryptographically broken. WEP uses RC4 with short static keys and weak IV generation that allows passive statistical attacks to crack the key with as little as 40,000 captured packets using tools like aircrack-ng. Any ICS environment still using WEP-secured Wi-Fi for SCADA communications or HMI access is critically exposed. WEP has been deprecated since 2004 and must be replaced with WPA2 or WPA3.

Question 47OT monitoring, change control, response and recovery

The MITRE ATT&CK for ICS framework defines which 'Initial Access' technique as a common first step in targeted ICS attacks?

  1. Drive-By Compromise targeting ICS operator browser sessions on isolated control networks
  2. Direct exploitation of internet-exposed PLC web interfaces as the primary initial access vector
  3. Spear-phishing targeting IT/corporate employees, with the goal of pivoting from the IT network into the adjacent OT network Correct answer.
  4. Physical destruction of ICS equipment as an initial access precursor

Explanation

MITRE ATT&CK for ICS (Enterprise overlap) identifies spear-phishing as a primary initial access technique. Attackers targeting OT typically do not attack OT systems directly from the internet; instead, they compromise IT employees first (via spear-phishing, watering holes), establish persistence on the IT network, then move laterally through IT-OT network connections (e.g., historian servers, remote access systems) into the OT environment. This IT-to-OT pivot pattern was seen in Stuxnet, Industroyer, and TRITON.

Question 48OT monitoring, change control, response and recovery

Which MITRE ATT&CK for ICS tactic corresponds to an adversary's goal of learning the structure and functionality of a target ICS environment before executing an attack?

  1. Execution
  2. Collection
  3. Discovery Correct answer.
  4. Lateral Movement

Explanation

In MITRE ATT&CK for ICS, 'Discovery' covers techniques where adversaries gather information about the ICS environment - including identifying control system devices, understanding network topology, locating historian servers, and enumerating PLCs and their I/O mappings. This knowledge is prerequisite to effective ICS attacks. Techniques in this tactic include Remote System Discovery, Network Sniffing (in IT ATT&CK, applies here), and BES Cyber System Information reconnaissance. Discovery typically occurs after initial access but before execution.

Question 49OT monitoring, change control, response and recovery

What is 'ICS threat intelligence' and how does it differ from enterprise IT threat intelligence?

  1. ICS threat intelligence is identical to IT threat intelligence; the same IOCs and TTPs apply
  2. ICS threat intelligence only covers physical attacks on industrial facilities
  3. ICS threat intelligence is only relevant for nuclear and defense facilities; commercial critical infrastructure uses standard IT threat intel
  4. ICS threat intelligence focuses specifically on threat actors targeting OT systems, ICS-specific malware (Industroyer, TRITON, Stuxnet), industrial protocol attack techniques, and sector-specific vulnerability advisories (ICS-CERT/CISA advisories, Dragos reports) - IOC types and attack TTPs differ significantly from enterprise IT threats Correct answer.

Explanation

ICS threat intelligence is sector-specific: (1) threat actors include nation-state groups (Sandworm, XENOTIME, Volt Typhoon) with demonstrated ICS capabilities; (2) malware families are ICS-specific (Industroyer/2, TRITON, PIPEDREAM/INCONTROLLER); (3) attack techniques involve ICS protocol manipulation rather than commodity exploit kits; (4) vulnerability advisories come from ICS-CERT/CISA, vendor advisories, and ICS security firms (Dragos, Claroty). Generic IT threat intel (Windows exploits, web app CVEs) provides little value for ICS defenders without ICS-specific context.

Question 50Cyber-risk identification and analysis

In ICS risk assessment, what does the term 'consequence' most specifically refer to?

  1. The impact of a successful attack, including safety, environmental, operational, and financial outcomes Correct answer.
  2. The likelihood that a specific vulnerability will be exploited
  3. The number of known vulnerabilities in a specific PLC firmware version
  4. The time required to patch an identified vulnerability

Explanation

In ICS risk assessment, consequence (or impact) refers to the potential outcome of a successful attack or failure event. For ICS, consequences extend beyond financial loss to include physical harm to personnel, environmental damage (spills, emissions), loss of life, equipment destruction, and societal impact. ICS risk assessments must explicitly account for these safety and environmental consequences, which are not typically considered in enterprise IT risk assessment.