AWWA Risk Assessment and Mitigation 2

Question 1

Which framework is most commonly used by water utilities to assess and prioritize security risks?

Accepted Answer

AWWA Risk and Resilience Management standard (ANSI/AWWA J100)

Answer

ANSI/AWWA J100 provides the RAM-W methodology specifically designed for water sector risk and resilience assessments.

Question 2

In a consequence analysis for a water system attack, which outcome is ranked MOST severe?

Accepted Answer

Public health impact causing mass casualties

Answer

Public health impacts involving mass casualties represent the highest severity consequence category in water system risk assessments.

Question 3

What is the purpose of a Vulnerability Assessment (VA) under America's Water Infrastructure Act (AWIA) 2018?

Accepted Answer

To identify and evaluate vulnerabilities and resilience of the water system

Answer

AWIA 2018 requires community water systems to assess system vulnerabilities, resilience, and consequences of malevolent acts or natural hazards.

Question 4

A water utility identifies that its SCADA system uses default vendor passwords. This is classified as what type of risk factor?

Accepted Answer

Vulnerability

Answer

Default passwords represent a vulnerability—a weakness in the system that a threat actor could exploit.

Question 5

When evaluating likelihood of a threat scenario, which factor primarily drives the probability estimate for an intentional attack?

Accepted Answer

Adversary capability and intent

Answer

For intentional threats, the likelihood is primarily determined by whether an adversary has the capability and intent to carry out the attack.

(AWWA) American Water Works Association Practice Test