I85PREP
⌘ K
Lead SCADA Security Manager study materials
Lead SCADA Security Manager study resources

Lead SCADA Security Manager practice questions

One question at a time. Build your Lead SCADA Security Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1SCADA Security

Under IEC 62443, which document defines the security requirements a system integrator must meet when delivering an automation solution to an asset owner?

  1. IEC 62443-4-1 product development requirements
  2. IEC 62443-4-2 component requirements
  3. IEC 62443-2-1 asset owner program requirements
  4. IEC 62443-3-3 system requirements Correct answer.

Explanation

IEC 62443-3-3 specifies the system-level security requirements (SR and RE families) that a system under consideration must satisfy at a given target security level. It is the reference used when integrating components into a delivered system. The other parts address components, the asset owner's program, or vendor development processes.

Question 2SCADA Security

In the Purdue model, a SCADA historian that collects process data from PLCs and serves read-only trend views to plant operators sits at which level?

  1. Level 3 Correct answer.
  2. Level 2
  3. Level 1
  4. Level 0

Explanation

Level 3 is the site operations layer, where historians, domain controllers and engineering workstations aggregate data from lower levels. Level 2 is supervisory control (HMI/SCADA servers), Level 1 is basic control (PLCs, RTUs) and Level 0 is the physical process.

Question 3SCADA Security

A SCADA engineer needs a firewall rule to let a Level 3 historian poll Modbus TCP data from a Level 1 RTU through a conduit. Which element of the zone-and-conduit model does this rule implement?

  1. A security level target
  2. A conduit between zones Correct answer.
  3. A zone boundary definition
  4. A compensating control

Explanation

A conduit is the controlled communication path that permits required traffic between two zones, and firewall rules enforcing protocol and direction are its concrete implementation. Zones group assets with common requirements; the rule itself is the conduit.

Question 4SCADA Security

Why is a data diode preferred over a stateful firewall for transferring operational data from a SCADA DMZ to a corporate business network?

  1. It authenticates each session with mutual TLS before allowing transfer.
  2. It enforces one-way physical flow so no return channel can be established. Correct answer.
  3. It inspects application payloads for malware signatures at line rate.
  4. It encrypts all payloads with site-managed keys before forwarding them.

Explanation

A data diode enforces unidirectional flow in hardware, so even a compromised corporate host cannot send commands or exploit a return path into the OT network. Firewalls permit bidirectional sessions by design and depend on correct rule sets.

Question 5SCADA Security

Which protocol should replace Telnet for administrative access to SCADA switches and RTUs to protect credentials in transit?

  1. SSH version 2 Correct answer.
  2. TFTP
  3. FTP
  4. SNMP version 1

Explanation

SSHv2 provides encrypted, authenticated interactive sessions and is the standard replacement for cleartext Telnet. SNMPv1, FTP and TFTP all transmit credentials or configuration data without encryption.

Question 6SCADA Security

A lead SCADA security manager must reduce risk from engineering workstations that dual-home onto both the control network and the corporate LAN. What is the most effective structural remediation?

  1. Require engineers to sign an acceptable-use policy for removable media.
  2. Install host antivirus and enable full-disk encryption on each workstation.
  3. Remove the corporate NIC and provide controlled data transfer through a DMZ jump host. Correct answer.
  4. Schedule weekly vulnerability scans of the workstations from the corporate LAN.

Explanation

Eliminating the dual-homed path removes the bridge between zones, which is the root cause of the exposure. Compensating host controls and policy do not remove the routable path an attacker can traverse.

Question 7SCADA Security

Which practice best protects the integrity of a SCADA safety instrumented system's logic while still allowing vendor support?

  1. Allow vendor laptops to connect directly to the SIS network on demand.
  2. Share the SIS administrator password with the vendor under an NDA.
  3. Grant vendors permanent remote desktop access to the SIS engineering server.
  4. Use a managed, time-bound remote access session with logging and approval. Correct answer.

Explanation

Time-bound, approved and logged remote sessions give support access while preserving accountability and limiting exposure windows. Permanent access, shared accounts and unmanaged laptops all break the SIS integrity boundary.

Question 8SCADA Security

In a SCADA incident response plan, what distinguishes the containment step for a safety instrumented system from that of a business IT system?

  1. Containment always begins with powering down every affected controller.
  2. Containment must weigh process and personnel safety before isolating assets. Correct answer.
  3. Containment is deferred until law enforcement authorizes any action.
  4. Containment relies on antivirus quarantine as the primary mechanism.

Explanation

Isolating or rebooting OT assets can itself create hazardous process states, so containment decisions must be coordinated with operations and safety personnel. IT containment assumes availability loss is tolerable, which does not hold for a plant.

Question 9SCADA Security

A SCADA security manager is defining a target security level for a zone containing the plant's primary control servers. What does IEC 62443 SL 3 primarily represent?

  1. Protection against intentional violation using sophisticated means with moderate resources. Correct answer.
  2. Protection against state-sponsored actors with extended resources.
  3. No specific protection requirement beyond physical access control.
  4. Protection against casual or accidental violation using simple means.

Explanation

SL 3 in IEC 62443 means the zone must resist intentional attacks mounted with sophisticated means and moderate resources, such as a determined insider or organized group. SL 1 and 2 cover casual or simple-means attacks, and SL 4 covers extended resources.

Question 10SCADA Security

Which control most directly mitigates the risk of an unauthorized laptop being plugged into a SCADA switch port to inject traffic?

  1. Increasing the switch's SNMP community string complexity
  2. Enabling storm control on uplink ports
  3. Configuring NTP authentication on the switch
  4. Enabling 802.1X port-based authentication on access ports Correct answer.

Explanation

802.1X requires a device to authenticate before the port passes traffic, blocking unauthorized endpoints. The other options address monitoring, availability or time integrity rather than port access.

Question 11SCADA Security

When planning patching for SCADA servers, why is a risk-based, staged approach preferred over immediate application of all vendor patches?

  1. Patches can alter control system behavior and require validation windows. Correct answer.
  2. Patches are never tested by vendors before release.
  3. Vendors prohibit patching of SCADA systems entirely.
  4. Patching always requires a full plant shutdown.

Explanation

OT patches can change process behavior or break validated configurations, so they are tested and applied in maintenance windows with rollback plans. Immediate blanket patching risks production outages that outweigh some vulnerabilities.

Question 12SCADA Security

A SCADA security manager wants to detect unauthorized changes to PLC logic. Which approach provides the strongest evidence of integrity?

  1. Annual penetration testing of the control network
  2. Continuous comparison of running logic against a known-good baseline Correct answer.
  3. Monthly review of Active Directory group membership
  4. Weekly review of firewall rule counters

Explanation

Comparing running controller logic to a trusted baseline detects unauthorized program changes directly. Firewall counters, directory reviews and periodic testing do not verify controller program integrity.

Question 13SCADA Security

Which is the primary reason to deploy unidirectional gateways rather than routed connections between the SCADA DMZ and the enterprise data center?

  1. To reduce the cost of network cabling
  2. To prevent inbound sessions that could reach control assets Correct answer.
  3. To improve the bandwidth of historian replication
  4. To simplify firewall rule documentation

Explanation

Unidirectional gateways remove the inbound path, so enterprise-side compromise cannot pivot toward control assets. Cost, bandwidth and documentation are secondary and not the security rationale.

Question 14SCADA Security

What is the primary security concern with using Modbus/TCP in a SCADA environment?

  1. It cannot operate over Ethernet.
  2. It requires public key certificates for each session.
  3. It lacks built-in authentication and encryption. Correct answer.
  4. It mandates TLS 1.3 for all transactions.

Explanation

Modbus/TCP has no native authentication, integrity or confidentiality, so any host that can reach the port can issue commands. It runs over Ethernet fine; it simply lacks modern security features.

Question 15SCADA Security

A SCADA security manager is asked to justify why IT-style vulnerability scanning should not be run indiscriminately against production PLCs. Which rationale is most accurate?

  1. Vulnerability data is irrelevant to OT risk assessments.
  2. PLC firmware cannot contain vulnerabilities.
  3. Active scanning can crash fragile controllers or disrupt process control. Correct answer.
  4. Scanners cannot reach OT networks under any circumstances.

Explanation

Many OT devices have limited network stacks and can hang or misbehave under active probing, so passive monitoring or vendor-approved testing is preferred. PLCs do have vulnerabilities, and scanners can reach OT if routing permits.

Question 16SCADA Security

Which element of a SCADA security program establishes who may approve changes to firewall rules protecting control zones?

  1. The vulnerability scan schedule
  2. The asset inventory spreadsheet
  3. The change management process with defined roles Correct answer.
  4. The network diagram repository

Explanation

Change management defines approval authority, roles and steps for modifying controls such as firewall rules. Diagrams, scan schedules and inventories are supporting artifacts, not approval mechanisms.

Question 17SCADA Security

A SCADA security manager observes repeated failed logins to an HMI from the corporate network. Which control would most directly limit this exposure?

  1. Adding the HMI to the vulnerability scan scope
  2. Increasing the HMI password length policy
  3. Removing the route between corporate and control zones Correct answer.
  4. Enabling HMI screen lockout after inactivity

Explanation

The failed logins imply reachable connectivity from a zone that should not reach the HMI; removing the route eliminates the exposure. Password and lockout policies help but do not stop the attempted access path.

Question 18SCADA Security

Which statement best describes the role of an OT security operations center in a SCADA environment?

  1. It monitors OT network traffic and alerts on anomalies affecting control assets. Correct answer.
  2. It manages the corporate email gateway and endpoint antivirus.
  3. It performs financial auditing of operational budgets.
  4. It designs the physical plant layout for new processes.

Explanation

An OT SOC focuses on monitoring control network traffic, detecting anomalies and coordinating response for OT assets. Corporate IT functions and plant design are outside its scope.

Question 19SCADA Security

When selecting a compensating control for a legacy RTU that cannot support encryption, which approach best preserves confidentiality of telemetry over an untrusted link?

  1. Segmenting the RTU into its own VLAN without encryption
  2. Relying on the RTU's proprietary protocol obscurity
  3. Increasing the polling frequency to reduce exposure time
  4. Encapsulating the telemetry in an encrypted tunnel between trusted gateways Correct answer.

Explanation

Wrapping legacy traffic in an encrypted tunnel between trusted endpoints protects confidentiality without modifying the RTU. Obscurity, VLANs and polling frequency do not provide encryption.

Question 20SCADA Security

A SCADA security manager is reviewing a vendor's secure development evidence under IEC 62443-4-1. Which artifact most directly demonstrates secure coding practices?

  1. A list of customer references
  2. A signed purchase order for the product
  3. A documented secure coding standard with code review records Correct answer.
  4. A marketing brochure describing product reliability

Explanation

IEC 62443-4-1 requires evidence of secure development practices, including coding standards and code review records. Commercial and marketing documents do not demonstrate secure development.

Question 21SCADA Security

Which practice most reduces the risk of a compromised USB drive introducing malware into a SCADA engineering workstation?

  1. Allowing engineers to use personal USB drives for convenience
  2. Scanning removable media in a dedicated kiosk before use in the control environment Correct answer.
  3. Relying on the workstation's screen saver to lock unattended sessions
  4. Disabling all logging of removable media events

Explanation

A controlled media kiosk scans and sanitizes removable media before it enters the OT environment, breaking a common infection path. Personal drives, disabled logging and screen savers do not address media-borne malware.

Question 22SCADA Security

In a SCADA risk assessment, why is a threat model that includes insider misuse essential?

  1. Insiders are always external contractors without credentials.
  2. Insiders have physical and logical access that can bypass perimeter defenses. Correct answer.
  3. Insider threats are covered automatically by firewalls.
  4. Threat modeling applies only to corporate IT systems.

Explanation

Insiders already hold trusted access and knowledge, so perimeter controls do not stop them; threat modeling must consider misuse of legitimate access. Firewalls address network boundaries, not authorized misuse.

Question 23SCADA Security

Which control best limits the impact of a compromised SCADA HMI on the rest of the control system?

  1. Allowing the HMI to reach all plant subnets for flexibility
  2. Giving the HMI domain administrator rights to simplify management
  3. Segmenting the HMI into a dedicated zone with restrictive conduits Correct answer.
  4. Disabling host-based logging to improve performance

Explanation

Placing the HMI in its own zone with tightly scoped conduits limits lateral movement if it is compromised. Broad privileges, disabled logging and unrestricted reach all increase impact.

Question 24SCADA Security

A SCADA security manager must verify that a new substation RTU meets the utility's security baseline before commissioning. Which activity provides the most direct verification?

  1. An interview with the procurement officer
  2. A configuration and hardening review against the baseline Correct answer.
  3. A review of the vendor's marketing materials
  4. A review of the substation's physical landscaping plan

Explanation

Comparing the deployed configuration against the baseline directly verifies hardening status. Marketing, procurement and landscaping do not evidence technical compliance.

Question 25SCADA Security

Why should SCADA security monitoring rely on passive network taps rather than active probing of controllers?

  1. Passive taps observe traffic without risking controller disruption. Correct answer.
  2. Passive taps eliminate the need for asset inventories.
  3. Passive taps can decrypt all encrypted traffic automatically.
  4. Active probing is prohibited by all network standards.

Explanation

Passive monitoring observes traffic copies and avoids the risk of active probes destabilizing fragile OT devices. Taps do not decrypt encrypted traffic, and they complement rather than replace inventories.

Question 26SCADA Security

Under IEC 62443-3-3, which requirement category addresses the ability of a control system to continue safe operation when a denial-of-service condition occurs?

  1. Audit log handling
  2. Restricted data flow
  3. Resource availability Correct answer.
  4. System availability

Explanation

IEC 62443-3-3 groups foundational requirements into seven categories, and resource availability (SR 7) specifically covers resilience against denial-of-service, including load limiting and fail-safe behavior. System availability is a broader security property rather than the named requirement category, so it does not identify the correct clause.

Question 27SCADA Security

A SCADA security manager is building the zone-and-conduit model for a water utility. Which input is most important when deciding where conduit boundaries belong?

  1. The number of operators assigned to each shift
  2. The procurement cost of the firewalls at each boundary
  3. The data flows required between assets to support each control function Correct answer.
  4. The physical cable routing drawings for each panel

Explanation

Zone and conduit design follows the communication dependencies needed by each control function, because the conduit exists to carry a defined set of flows under defined protections. Cable drawings, firewall cost, and staffing do not describe the functional data exchange that determines whether two assets must share a zone or be joined by a conduit.

Question 28SCADA Security

Which document produced during the IEC 62443-3-2 process records the target security level assigned to each zone and the rationale behind it?

  1. The zone and conduit risk assessment report Correct answer.
  2. The system integration acceptance test plan
  3. The cybersecurity requirements specification
  4. The asset inventory register

Explanation

The zone and conduit risk assessment establishes the target security level for each zone together with the justification, and it becomes the reference for later design decisions. The requirements specification translates those targets into verifiable requirements, while the test plan and inventory serve different purposes.

Question 29SCADA Security

A SCADA security manager must decide how to segment a plant network that currently has a single flat VLAN shared by HMIs, historians, and PLCs. Which first step best supports a defensible segmentation design?

  1. Replace all unmanaged switches with managed switches
  2. Document the control data flows and their required protocols between each asset group Correct answer.
  3. Deploy an intrusion prevention system at the plant perimeter
  4. Enable port security on every access switch in the plant

Explanation

Segmentation must be driven by an accurate model of which assets talk to which, using which protocols, so that zones and conduits reflect real functional needs. Port security, perimeter IPS, and switch replacement are useful controls but cannot tell the manager where to place boundaries.

Question 30SCADA Security

In a SCADA environment, what is the primary purpose of a demilitarized zone between the enterprise network and the control network?

  1. To provide a backup path for control traffic if the primary network fails
  2. To terminate all remote access VPN sessions for field technicians
  3. To broker and inspect the limited data exchanges permitted between the two networks Correct answer.
  4. To host the engineering workstations used for PLC programming

Explanation

A control DMZ exists to break direct connectivity between enterprise and control networks so that only explicitly permitted, brokered flows cross the boundary. Placing VPN termination, programming workstations, or redundant control paths there would reintroduce the direct exposure the DMZ is meant to prevent.

Question 31SCADA Security

A SCADA security manager is choosing how to authenticate engineers who access PLCs from a shared maintenance laptop. Which approach best limits the blast radius of a stolen credential?

  1. Individual accounts issued per engineer with multi-factor authentication at the jump host Correct answer.
  2. Certificate-based authentication stored on the shared laptop
  3. A single vendor account enabled only during maintenance windows
  4. A shared local account on each PLC with a strong password

Explanation

Attributable individual accounts combined with MFA at a controlled jump host ensure that a stolen credential alone is insufficient and that actions can be traced to a person. Shared or laptop-stored credentials remain usable by anyone holding the device, which defeats the purpose.

Question 32SCADA Security

Why should a SCADA security manager require that security event logs from controllers be forwarded to a protected central collector rather than stored only on the device?

  1. Forwarding logs is the only way to satisfy patch management requirements
  2. An attacker who compromises the device can erase or alter its local records Correct answer.
  3. Local storage on controllers is usually too small to hold more than a few events
  4. Central collection is required for the controller to meet its real-time cycle time

Explanation

Logs kept only on the source device are vulnerable to deletion or tampering by an intruder who gains control of that device, so forwarding to a hardened collector preserves evidence. Storage size, cycle time, and patching are not the governing reason for centralized collection.

Question 33SCADA Security

A SCADA security manager is asked to approve a remote vendor connection for diagnostics. Which arrangement best preserves least privilege and accountability?

  1. Direct internet-facing access to the affected controller on a nonstandard port
  2. A shared service account with a password changed after each engagement
  3. A persistent always-on VPN tunnel to the vendor's network
  4. Time-limited, supervised access through a jump host with session recording and per-session approval Correct answer.

Explanation

Time-bound, approved, and recorded sessions through a controlled jump host give the vendor only the access needed for the task while producing evidence of what was done. Persistent tunnels, shared accounts, and direct exposure all grant broader or untraceable access than the work requires.

Question 34SCADA Security

In a SCADA security program, which metric best indicates whether the patching process for control assets is actually reducing exposure?

  1. The total number of patches released by vendors during the year
  2. The count of change requests submitted to the change advisory board
  3. The average number of hours the patching team spends per month
  4. The percentage of known, applicable vulnerabilities on control assets that remain unmitigated beyond the approved risk window Correct answer.

Explanation

Exposure reduction is measured by how many applicable vulnerabilities remain unmitigated past the organization's accepted timeframe, accounting for compensating controls. Vendor release counts, labor hours, and change volume describe activity rather than residual risk.

Question 35SCADA Security

Which property of the Purdue model makes it useful to a SCADA security manager defining trust boundaries?

  1. It defines the maximum number of devices allowed on a control network
  2. It specifies the exact firewall vendor to deploy at each level
  3. It organizes control functions into hierarchical levels so trust relationships can be assigned per level Correct answer.
  4. It mandates encryption algorithms for each industrial protocol

Explanation

The Purdue enterprise reference model arranges control and enterprise functions into hierarchical levels, which gives the security manager a basis for assigning trust and placing boundaries between them. It does not prescribe vendors, cryptographic algorithms, or device counts.

Question 36SCADA Security

A SCADA security manager finds that a plant's safety instrumented system shares a network switch with the basic process control system. Which argument most strongly supports separating them?

  1. Separation prevents faults or attacks in the process control network from degrading the safety function Correct answer.
  2. Separation eliminates the need for any safety system access controls
  3. Separation allows the safety system to use faster Ethernet hardware
  4. Separation reduces the cost of switch maintenance contracts

Explanation

Independence between the safety instrumented system and the basic process control system limits the chance that a compromise or traffic storm in one affects the other's ability to perform its safety function. Cost, hardware speed, and access control needs are not the security rationale for independence.

Question 37SCADA Security

When a SCADA security manager evaluates an anomaly detection product for the control network, which capability matters most for avoiding disruption to operations?

  1. The ability to block suspicious traffic inline by default
  2. The ability to learn normal protocol behavior and alert passively before any enforcement is enabled Correct answer.
  3. The ability to automatically reboot controllers that show anomalous behavior
  4. The ability to run active vulnerability scans against controllers on a schedule

Explanation

Passive learning of normal behavior lets the tool detect deviations without injecting traffic or blocking legitimate control messages, which protects availability while the model matures. Inline blocking by default, active scanning, and automated reboots all risk disrupting the process.

Question 38SCADA Security

Which artifact from a SCADA system integrator most directly demonstrates that security requirements were verified before handover?

  1. The security verification and validation records mapped to the project's security requirements Correct answer.
  2. The operator training attendance sheet
  3. The factory acceptance test report for the process logic only
  4. The bill of materials listing installed network equipment

Explanation

Verification and validation records that trace back to the project's stated security requirements show that each requirement was tested and met before acceptance. A functional test report, a bill of materials, and training records do not demonstrate security requirement verification.

Question 39SCADA Security

A SCADA security manager wants to reduce the chance that a single compromised account can alter setpoints across multiple production lines. Which design choice best achieves this?

  1. Scoping operator accounts to the specific line and functions they are assigned, with changes requiring separate authorization Correct answer.
  2. Granting each operator a domain administrator account for convenience
  3. Rotating a single plant-wide password on a fixed schedule
  4. Relying on the PLC's built-in password protection for each line

Explanation

Least-privilege scoping combined with separate authorization for setpoint changes limits how far one compromised account can reach. Broad administrator rights, PLC-local passwords, and shared rotating passwords all preserve excessive reach or weak accountability.

Question 40SCADA Security

Why does a SCADA security manager treat the results of a control network asset discovery scan as sensitive information requiring protection?

  1. Because the inventory reveals device models, firmware versions, and topology that an attacker could use to plan an intrusion Correct answer.
  2. Because sharing results with vendors is prohibited by all contracts
  3. Because the scan results are only useful for billing purposes
  4. Because discovery results are required to be published under open standards

Explanation

A detailed asset inventory is effectively a map of exploitable weaknesses, since it exposes models, firmware, and network layout that guide targeting. Treating it as sensitive limits reconnaissance value if the document leaks; the other options misstate why the data is protected.

Question 41Cybersecurity Management

A utility's SCADA security program must assign accountability for operational technology risk. Which arrangement best reflects recognized governance practice for a Lead SCADA Security Manager?

  1. Rotating risk ownership monthly among shift operators to spread awareness
  2. Leaving OT risk ownership with the enterprise IT risk committee only
  3. Delegating all OT risk decisions to the SCADA vendor's account team
  4. Assigning OT risk ownership to a named security leader with authority over control system assets Correct answer.

Explanation

Effective governance requires a clearly named accountable owner who has authority over the OT environment, so that risk decisions are made with control-system context and can be enforced. Diffuse or vendor-held ownership leaves no one empowered to accept or remediate OT risk.

Question 42Cybersecurity Management

Which document most appropriately establishes the security expectations that a SCADA security manager uses to hold engineering teams accountable?

  1. The incident response runbook for the substation control center
  2. The annual penetration test report
  3. The approved OT security policy and supporting standards Correct answer.
  4. The vendor's product security whitepaper

Explanation

Policy and standards define mandatory expectations and are the basis for measuring and enforcing compliance across engineering teams. Runbooks, vendor whitepapers, and test reports inform or support the program but do not set enterprise-wide requirements.

Question 43Cybersecurity Management

A SCADA security manager is building the risk register for the OT estate. Which entry characteristic makes a risk item most actionable for management review?

  1. A reference to the latest industry threat report headline
  2. A description linking the threat, the vulnerable asset, the potential operational consequence, and a named owner Correct answer.
  3. A qualitative label such as high, medium, or low with no further detail
  4. A list of every vulnerability scanner finding across the plant network

Explanation

Actionable risk entries tie together cause, affected asset, business or safety consequence, and accountability so that treatment decisions can be made and tracked. Bare severity labels and raw scanner output lack the consequence and ownership context management needs.

Question 44Cybersecurity Management

Which metric best demonstrates to executive leadership that the SCADA security program is reducing exposure over time?

  1. The number of vendor meetings held during the quarter
  2. The count of unpatched critical vulnerabilities on internet-exposed OT assets trending downward Correct answer.
  3. The number of security awareness emails sent to plant staff
  4. The total number of firewall rules configured at the plant boundary

Explanation

A meaningful program metric measures a risk-reducing outcome, such as declining exposure of critical OT assets, and can be trended. Activity counts and configuration volumes show effort but not whether risk is actually falling.

Question 45Cybersecurity Management

Under a typical OT security governance model, what is the primary responsibility of the asset owner for a generating unit?

  1. Approving the enterprise firewall architecture for the corporate data center
  2. Accepting residual operational risk for that unit and funding required controls Correct answer.
  3. Writing the corporate security awareness curriculum
  4. Performing daily vulnerability scans of the unit's control network

Explanation

Asset owners are accountable for the operational asset and therefore accept residual risk and authorize funding for controls on it. Scanning, architecture approval, and training content belong to specialist or enterprise functions.

Question 46Cybersecurity Management

A regulator asks how the utility ensures third-party integrators meet SCADA security requirements. Which control is the most direct evidence of management oversight?

  1. Asking integrators verbally to follow good practice on site
  2. Allowing integrators to self-certify without any review
  3. Requiring integrators to sign a contract clause with defined security obligations and audit rights, then verifying compliance Correct answer.
  4. Relying on the integrator's reputation in the industry

Explanation

Contractual security obligations paired with audit rights and verification create enforceable, documented oversight of third parties. Verbal requests, reputation, and unchecked self-certification provide no auditable assurance.

Question 47Cybersecurity Management

Which activity belongs to the 'monitor' phase of a SCADA security management cycle rather than to design or implementation?

  1. Deploying a new industrial firewall at the plant boundary
  2. Reviewing security event logs and alert trends from the control network Correct answer.
  3. Writing the OT acceptable use standard
  4. Designing network segmentation for the substation LAN

Explanation

Monitoring covers ongoing observation of events and trends to detect and understand security issues. Standards authoring, device deployment, and segmentation design are plan-and-implement activities.

Question 48Cybersecurity Management

A SCADA security manager must decide how to treat a risk that cannot be technically mitigated without shutting down a critical process. Which management action is most appropriate?

  1. Ignore the risk because the process cannot be interrupted
  2. Transfer the entire risk to the equipment vendor
  3. Formally document acceptance of the residual risk with compensating controls and a review date Correct answer.
  4. Delete the risk from the register to keep reporting clean

Explanation

When mitigation is constrained by operational necessity, documented risk acceptance with compensating controls, approval, and scheduled review keeps the decision transparent and governed. Ignoring, hiding, or fully transferring the risk removes accountability without reducing exposure.

Question 49Cybersecurity Management

A new corporate IT security directive mandates full-disk encryption and agent-based endpoint detection on all computing devices. How should the SCADA security manager respond regarding legacy control system servers?

  1. Reject the directive outright and take no further action
  2. Wait for the servers to fail before addressing the requirement
  3. Assess compatibility and operational impact, then define an OT-specific exception with compensating controls Correct answer.
  4. Apply the directive immediately to all OT servers to ensure uniform compliance

Explanation

OT systems often cannot tolerate endpoint agents or encryption without vendor validation and change control, so the manager should assess impact and negotiate a documented exception with compensating controls. Blind application risks outages, while blanket rejection or inaction undermines governance.

Question 50Cybersecurity Management

During budget planning, the SCADA security manager must justify a network monitoring investment. Which argument is strongest for an OT audience?

  1. It enables earlier detection of unauthorized changes to control system networks, reducing potential outage duration Correct answer.
  2. It matches a capability a peer utility purchased last year
  3. It replaces the need for patching control systems
  4. It increases the number of alerts the security team can generate

Explanation

OT stakeholders fund controls that protect availability and safety, so framing monitoring as earlier detection of unauthorized change and reduced outage impact is persuasive. Peer imitation, alert volume, and claims of replacing patching are weak or misleading justifications.